safeurl is Missing IPv6 CIDR Ranges in Blocklist (CVE-2026-54452)
Description
safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6(true), an attacker-controlled destination in one of these ranges is not recognized as non-public and can pass the SSRF destination check, potentially allowing access to resources hosted within the omitted ranges. IPv6 is disabled by default, and configurations that retain EnableIPv6(false) are not exposed to this bypass. This issue is fixed in version 0.2.4.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
safeurl is a server-side request forgery (SSRF) protection library that maintains a list of private network CIDR ranges to block SSRF attempts. Versions before 0.2.4 omit several IPv6 CIDR ranges (64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64) from this list. When an application enables IPv6 support via EnableIPv6(true), destinations within these omitted IPv6 ranges are not treated as private and thus bypass the SSRF destination check. This allows potential SSRF attacks targeting resources within these IPv6 ranges. The issue does not affect configurations with IPv6 disabled (EnableIPv6(false)). The vulnerability is addressed by adding the missing IPv6 CIDR ranges in version 0.2.4.
Potential Impact
Applications using safeurl versions prior to 0.2.4 with IPv6 enabled may allow SSRF attacks to destinations in the omitted IPv6 CIDR ranges. This could lead to unauthorized access to internal or protected IPv6 resources that should have been blocked by SSRF protections. The impact is limited to configurations enabling IPv6, which is disabled by default.
Mitigation Recommendations
Upgrade safeurl to version 0.2.4 or later, which includes the missing IPv6 CIDR ranges in the privateNetworks blocklist, effectively fixing the SSRF bypass. If upgrading is not immediately possible, ensure that IPv6 is disabled (EnableIPv6(false)) to avoid exposure to this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-xgch-x3mx-cm3c
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-54452"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a58b41468715ace43d68313
Added to database: 07/16/2026, 10:36:04 UTC
Last enriched: 09/21/2026, 22:17:12 UTC
Last updated: 10/17/2026, 18:48:20 UTC
Views: 123
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.