Vaultwarden, a Bitwarden‑compatible server written in Rust, had a vulnerability in its icon‑fetching endpoint. The endpoint /icons/{domain}/icon.png used src/http_client.rs checks, including should_block_address() and post_resolve(), that omitted validation for decimal, hexadecimal, and octal IP representations. This omission allowed attackers to inject IP addresses in various numeric formats, leading to server‑side requests to internal addresses. The result was blind discovery of internal network resources and port information. The flaw is a server‑side request forgery (CWE‑918) coupled with address parsing errors (CWE‑1389). It was resolved in version 1.36.0.

The vulnerability affects all installations of Vaultwarden (dani‑garcia:vaultwarden) running versions before 1.36.0. Users running those older releases should upgrade to the patched 1.36.0 release or later.

The CVSS base score of 5.8 indicates a medium‑severity flaw; the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The flaw is not listed in the CISA KEV catalog. An attacker could exploit it by sending crafted requests to the icon endpoint with IP addresses encoded in decimal, hexadecimal, or octal forms to provoke the server to access internal resources, potentially revealing service information or ports. Successful exploitation requires network access to the Vaultwarden instance and the ability to inject the malicious URL, but does not require additional privileged access.