CVE-2026-54452

mediumcovered by 1 sourcefirst seen 2026-07-15

The privateNetworks blocklist was found to be missing newly added CIDR ranges. More specifically, the following CIDR ranges were not being blocked: - 64:ff9b:1::/48: NAT64 local-use prefix (RFC 8215) - 5f00::/16: Segment Routing (SRv6) SIDs (RFC 9602) - 3fff::/20: documentation prefix (RFC 9637) - 100:0:0:1::/64: Dummy IPv6 Prefix (RFC 9780) Impact If exploited, an attacker would potentially be able to reach resources hosted on the IPs residing in the missing ranges. Workarounds Disable IPv6 by setting EnableIPv6(false). This is the default behavior of the library. Resolution Upgrade to v0.2.4 Credits safeurl thanks @tonghuaroot for reporting.

⚡ Watch CVE-2026-54452

Get an email if CVE-2026-54452 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

mediumGHSA-xgch-x3mx-cm3c: safeurl is Missing IPv6 CIDR Ranges in Blocklistghsa · 2026-07-15

External references

NVD record for CVE-2026-54452

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-54452 status](https://www.csirts.com/badge/CVE-2026-54452)](https://www.csirts.com/cve/CVE-2026-54452)