GHSA-xgch-x3mx-cm3c: safeurl is Missing IPv6 CIDR Ranges in Blocklist
The privateNetworks blocklist was found to be missing newly added CIDR ranges. More specifically, the following CIDR ranges were not being blocked:
- 64:ff9b:1::/48: NAT64 local-use prefix (RFC 8215)
- 5f00::/16: Segment Routing (SRv6) SIDs (RFC 9602)
- 3fff::/20: documentation prefix (RFC 9637)
- 100:0:0:1::/64: Dummy IPv6 Prefix (RFC 9780)
Impact
If exploited, an attacker would potentially be able to reach resources hosted on the IPs residing in the missing ranges.
Workarounds
Disable IPv6 by setting EnableIPv6(false). This is the default behavior of the library.
Resolution
Upgrade to v0.2.4
Credits
safeurl thanks @tonghuaroot for reporting.
Details
Original advisory: https://github.com/advisories/GHSA-xgch-x3mx-cm3c
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-54452 | coverage & exploitation status | NVD · CVE.org |
More from GitHub Security Advisories
- mediumGHSA-jr6p-8pjj-mfx6: Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators s…2026-07-31
- mediumGHSA-68cj-mvg9-rgm2: Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing…2026-07-31
- mediumGHSA-ff84-5f28-78qj: re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex`…2026-07-31
- mediumGHSA-6hxr-mr5r-9836: re2: Global `String.prototype.match` with an empty-matchable pattern never advances → inf…2026-07-31
- mediumGHSA-x83g-979r-f5fh: Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII2026-07-31