SSRF protection bypass via NAT64 prefix in CC-Tweaked (CVE-2026-47695)

CC-Tweaked's HTTP API blocks requests to private network ranges to prevent server-side request forgery (SSRF), but this protection can be bypassed on IPv6-capable servers by addressing internal IPv4 services using NAT64 well-known prefix addresses (`64:ff9b::/96`). Java's built-in `InetAddress` classification methods do not recognize this prefix, so the address passes the filter and connections are forwarded to internal IPv4 services via network-level NAT64 translation. Any user able to execute Lua code on a CC-Tweaked computer can reach internal services - including cloud infrastructure APIs and internal databases - that the HTTP filter is intended to block. Affected versions: - <1.119.0 We recommend updating to: 1.119.0. CVSS 7.1 · our assessment: this_week Reference: https://github.com/cc-tweaked/CC-Tweaked/security/advisories/GHSA-5jh9-2h63-pw4q Details: https://vuln.today/cve/CVE-2026-47695