Lancet up to version 2.3.9 contains a server‑side request forgery protection bypass. The problem lies in the netutil.IsInternalIP function, which incorrectly labels certain IPv6 address forms—private, link‑local, CGNAT, and transition addresses—as external. An attacker who can supply a hostname that resolves to one of those addresses, such as NAT64, 6to4 or Teredo forms that embed an internal IPv4 address, is able to force the application to fetch data from internal services or cloud metadata endpoints. The vulnerability, classified as CWE‑918, results in the ability to access sensitive internal resources or cloud metadata, with potential confidentiality and availability impacts.

The affected product is Lancet from the lancet_project. Versions up to and including 2.3.9 are affected. No specific patch version is listed, but the bug is known to exist in the 2.3.9 release and earlier.

The CVSS score of 6.3 indicates a moderate severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified from the advisory. The vulnerability is not listed in CISA's KEV catalog. Attackers can exploit the flaw by providing a crafted hostname or DNS entry that resolves to an internally routable address. The attack would typically be performed over the network connection from the application to external hosts, so the attack vector is inferred to be Network.