EUVD-2026-77630
GHSA-xgch-x3mx-cm3c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because IPv6 must be explicitly enabled (non-default); S:C because SSRF crosses a trust boundary to subsequent systems; C:L for limited internal resource read access; no integrity or availability impact.
Primary rating from Vendor (https://github.com/doyensec/safeurl).
CVSS VectorVendor: https://github.com/doyensec/safeurl
Lifecycle Timeline
3DescriptionCVE.org
The privateNetworks blocklist was found to be missing newly added CIDR ranges. More specifically, the following CIDR ranges were not being blocked:
64:ff9b:1::/48: NAT64 local-use prefix (RFC 8215)5f00::/16: Segment Routing (SRv6) SIDs (RFC 9602)3fff::/20: documentation prefix (RFC 9637)100:0:0:1::/64: Dummy IPv6 Prefix (RFC 9780)
Impact
If exploited, an attacker would potentially be able to reach resources hosted on the IPs residing in the missing ranges.
Workarounds
Disable IPv6 by setting EnableIPv6(false). This is the default behavior of the library.
Resolution
Upgrade to v0.2.4
Credits
safeurl thanks @tonghuaroot for reporting.
AnalysisAI
SSRF protection bypass in the Doyensec safeurl Go library (versions prior to 0.2.4) allows network requests to four newly standardized IPv6 CIDR ranges that were absent from the library's internal blocklist. Applications that explicitly enable IPv6 via EnableIPv6(true) and rely on safeurl to enforce SSRF controls are exposed; attackers who can supply attacker-controlled URLs to such applications may reach internal resources hosted on NAT64 local-use (64:ff9b:1::/48), SRv6 SID (5f00::/16), documentation (3fff::/20), or Dummy IPv6 (100:0:0:1::/64) address space. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
safeurl (pkg:go/github.com/doyensec/safeurl) is a Go library maintained by Doyensec specifically designed to prevent Server-Side Request Forgery by maintaining a curated blocklist of private and reserved network ranges. The root cause is CWE-918 (Server-Side Request Forgery) in the form of an incomplete denylist: four IPv6 prefixes codified by recent RFCs were never added to the privateNetworks blocklist. These are 64:ff9b:1::/48 (NAT64 local-use, RFC 8215), 5f00::/16 (Segment Routing SRv6 SIDs, RFC 9602), 3fff::/20 (documentation prefix, RFC 9637), and 100:0:0:1::/64 (Dummy IPv6 Prefix, RFC 9780). Because these ranges were legitimate protocol-assigned IPv6 space not yet reflected in the library, requests targeting them slipped through the filter entirely when IPv6 was enabled.
RemediationAI
The primary fix is to upgrade to safeurl v0.2.4, which expands the private network blocklist to include all four missing IPv6 CIDR ranges; the release is available at https://github.com/doyensec/safeurl/releases/tag/v0.2.4. For applications that cannot immediately upgrade, the vendor-documented workaround is to call EnableIPv6(false) in the safeurl configuration, which disables IPv6 URL resolution entirely and eliminates exposure to this bypass; this is also the library's default behavior, so applications that have not explicitly enabled IPv6 are not exposed without any code change. Note that disabling IPv6 may impact legitimate use cases if the application is expected to resolve IPv6-only hostnames or dual-stack resources. No additional compensating controls beyond disabling IPv6 or upgrading are warranted given the narrow scope of the bypass.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today