Server-Side Request Forgery Vulnerability in Safeurl Library by Doyensec
CVE-2026-54452

6.3MEDIUM

Key Information:

Vendor

Doyensec

Status
Safeurl
Vendor
CVE Published:
14 September 2026

What is CVE-2026-54452?

The Safeurl library, a server-side request forgery protection tool, has a vulnerability that affects applications using IPv6. Specifically, versions prior to 0.2.4 omit certain IPv6 ranges (64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64) from the privateNetworks check in ip.go. This oversight means that if an application enables IPv6, an attacker can exploit this gap by crafting an SSRF request that targets an address within these ranges, bypassing the intended protection. Users are advised to update to version 0.2.4 or later to mitigate this risk.

Affected Version(s)

safeurl < 0.2.4

References

https://github.com/doyensec/safeurl/security/advisories/G...
x_refsource_CONFIRM
https://github.com/doyensec/safeurl/pull/12
x_refsource_MISC
https://github.com/doyensec/safeurl/commit/d8f1021ea535b2...
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.