Lancet netutil CVE-2026-110240

The target application must (a) use lancet netutil.IsInternalIP (vulnerable versions 1.3.1-1.4.6 or 2.1.2-2.3.9) as its SSRF allow/deny decision, and (b) accept attacker-controlled hostnames or URLs and fetch them server-side. Exploitation specifically requires supplying addresses the pre-patch logic misclassifies as external: IPv6 ULA private (fd00::/8), link-local (fe80::/10), RFC 6598 CGNAT (100.64.0.0/10), or transition encodings embedding internal IPv4 - NAT64 (64:ff9b::/96), 6to4 (2002::/16), or Teredo (2001:0::/32). Limiting factors: exploitation is bounded by the consuming app actually relying on this function (a library dependency, not a standalone service), the need for the internal/metadata target to be reachable over the chosen address form, and SSVC Automatable=no, indicating it is not reliably scriptable at scale.

Signals point to a genuine but moderate-priority issue rather than an emergency. The vendor CVSS 4.0 score is 6.3 (MEDIUM) with AV:N/AC:L/AT:P/PR:N/UI:N, meaning network-reachable and unauthenticated, but the AT:P (Attack Requirements: Present) flag signals that exploitation depends on specific preconditions - namely that the consuming application uses lancet's netutil.IsInternalIP as its SSRF guard and processes attacker-controlled IPv6/transition hostnames. The vulnerable library itself takes no direct impact (VC:N/VI:N/VA:N); the scored harm is to the subsequent/internal system (SC:L/SI:L), which is exactly the SSRF pivot behavior. SSVC corroborates a measured risk profile: Exploitation=poc (proof-of-concept exists, not confirmed in-the-wild), Automatable=no (not suitable for mass/scripted exploitation), Technical Impact=partial. This is NOT in CISA KEV, so there is no evidence of active exploitation. No EPSS score was provided, so exploitation probability cannot be quantified from the input. Net assessment: this is a real defense-in-depth bypass worth patching promptly in any service that relies on lancet for SSRF filtering, but the Automatable=no rating and the library-dependency precondition argue against treating it as a widespread, drive-by-exploitable CVE.

A web application uses lancet's netutil.IsInternalIP to block SSRF by rejecting user-supplied URLs that resolve to internal addresses. An attacker submits a hostname resolving to an IPv6 transition address such as a NAT64 (64:ff9b::a9fe:a9fe) or 6to4/Teredo form embedding an internal IPv4, which the flawed check misclassifies as external and allows. The server then connects to the internal target - for example 169.254.169.254 cloud metadata - returning credentials or internal data. Proof-of-concept exploit code exists (per SSVC poc rating and the VulnCheck advisory).