Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/doyensec/safeurl

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.9GoPublished

    safeurl is Missing IPv6 CIDR Ranges in Blocklist

    CVE-2026-54452 · GHSA-xgch-x3mx-cm3c

    Affected
    • Go github.com/doyensec/safeurl < 0.2.4
    Fixed in
    0.2.4· Vendor fix available
    Issue
    The privateNetworks blocklist was found to be missing newly added CIDR ranges. More specifically, the following CIDR ranges were not being blocked: - 64:ff9b:1::/48: NAT64 local-use prefix (RFC 8215) - 5f00::/16: Segment Routing (SRv6) SIDs (RFC 9602) - 3fff::/20: documentation prefix (RFC 9637) - 100:0:0:1::/64: Dummy IPv6 Prefix (RFC 9780) Impact If exploited, an attacker would potentially be able to reach resources hosted on the IPs residing in the missing ranges. Workarounds Disable IPv6 by setting EnableIPv6(false). This is the default behavior of the library. Resolution Upgrade to v0.2.4 Credits safeurl thanks @tonghuaroot for reporting.

    Recommended action: Upgrade to 0.2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →