CVE-2026-54452

safeurl: Missing IPv6 CIDR Ranges in Blocklist

Published Sep 14, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6(true), an attacker-controlled destination in one of these ranges is not recognized as non-public and can pass the SSRF destination check, potentially allowing access to resources hosted within the omitted ranges. IPv6 is disabled by default, and configurations that retain EnableIPv6(false) are not exposed to this bypass. This issue is fixed in version 0.2.4.

Analysis

Technical impact

The safeurl library protects against SSRF by blocking requests to private network ranges. Prior to version 0.2.4, its privateNetwork list omitted the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 via EnableIPv6(true), a destination in any of these omitted ranges is incorrectly treated as public and passes the SSRF check, potentially allowing an attacker to access internal resources hosted in the omitted ranges. Although IPv6 is disabled by default, configurations that enable it remain vulnerable until upgraded to v0.2.4 or later.

Affected Systems

The vulnerability applies to the Doyensec safeurl library, versions earlier than 0.2.4. The fix was introduced in v0.2.4 and there are no known gaps in higher releases. Users running older releases that still enable IPv6 are affected.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity, and the issue is not currently listed in CISA’s KEV catalog. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability. The flaw can be leveraged by any actor who can influence the destination URL in an application that has IPv6 enabled. Based on the description, it is inferred that the attack vector is application-level, requiring the attacker to trigger an HTTP request to a target, and the conditional check falls through when IPv6 is active, allowing internal network access.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

doyensec

safeurl

affected

Version	Status	Constraints
`< 0.2.4`	affected	—

No data.

Vendor Product Versions

Doyensec

Safeurl

Version	Status	Scheme	Platform
`[0,0.2.4)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade safeurl to version 0.2.4 or later
If upgrading is not immediately possible, disable IPv6 in the application configuration by setting EnableIPv6(false)
Confirm that the private network blocklist includes all relevant IPv6 ranges or customize the list to include missing ranges

Generated by OpenCVE AI on September 21, 2026 at 00:06 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-xgch-x3mx-cm3c	safeurl is Missing IPv6 CIDR Ranges in Blocklist

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.521% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/doyensec/safeurl/commit/d8f1021ea535b276f92999f0ec865da40e467016
https://github.com/doyensec/safeurl/pull/12
https://github.com/doyensec/safeurl/releases/tag/v0.2.4
https://github.com/doyensec/safeurl/security/advisories/GHSA-xgch-x3mx-cm3c

History

Sep 17, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Doyensec Doyensec safeurl
Vendors & Products		Doyensec Doyensec safeurl

Sep 16, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 14, 2026 9:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6(true), an attacker-controlled destination in one of these ranges is not recognized as non-public and can pass the SSRF destination check, potentially allowing access to resources hosted within the omitted ranges. IPv6 is disabled by default, and configurations that retain EnableIPv6(false) are not exposed to this bypass. This issue is fixed in version 0.2.4.
Title		safeurl: Missing IPv6 CIDR Ranges in Blocklist
Weaknesses		CWE-918
References		https://github.com/doyensec/safeurl/commit/d8f1021ea535b276f92999f0ec865da40e467016 https://github.com/doyensec/safeurl/pull/12 https://github.com/doyensec/safeurl/releases/tag/v0.2.4 https://github.com/doyensec/safeurl/security/advisories/GHSA-xgch-x3mx-cm3c
Metrics		cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'}`