Server-side Request Forgery in EricLBuehler's Mistral.rs Application
CVE-2026-108939

6.9MEDIUM

Key Information:

Vendor

Ericlbuehler

Status
Mistral.rs
Vendor
CVE Published:
12 October 2026

What is CVE-2026-108939?

A vulnerability has been identified in the Mistral.rs application by EricLBuehler, impacting versions up to 0.9.3. This flaw arises from improper handling of the 'ip' argument in the is_global_ip function, allowing for remote exploitation through server-side request forgery. Attackers may leverage this vulnerability to manipulate servers and access internal resources. To mitigate the risk, users are advised to upgrade to version 0.9.4, which includes necessary patches to eliminate this security issue. Detailed patch information can be found in the commits on the official GitHub repository.

Affected Version(s)

mistral.rs 0.9.0

mistral.rs 0.9.1

mistral.rs 0.9.2

References

https://vuldb.com/vuln/416763
vdb-entrytechnical-description
https://vuldb.com/vuln/416763/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108939
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

carfeii (VulDB User)
.