{"id":"CVE-2026-54452","aliases":["GO-2026-5997"],"url":"https://o3.security/vulnerability/CVE-2026-54452","summary":"safeurl is Missing IPv6 CIDR Ranges in Blocklist","details":"The `privateNetworks` blocklist was found to be missing newly added CIDR ranges. More specifically, the following CIDR ranges were not being blocked:\n- `64:ff9b:1::/48`: NAT64 local-use prefix (RFC 8215)\n- `5f00::/16`: Segment Routing (SRv6) SIDs (RFC 9602)\n- `3fff::/20`: documentation prefix (RFC 9637)\n- `100:0:0:1::/64`: Dummy IPv6 Prefix (RFC 9780)\n\n### Impact\nIf exploited, an attacker would potentially be able to reach resources hosted on the IPs residing in the missing ranges.\n\n### Workarounds\nDisable IPv6 by setting `EnableIPv6(false)`. This is the default behavior of the library.\n\n### Resolution\nUpgrade to v0.2.4\n\n### Credits\nsafeurl thanks @tonghuaroot for reporting.","published":"2026-07-15T21:58:03Z","modified":"2026-07-21T19:19:10.724316633Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/doyensec/safeurl","fixedVersion":"0.2.4"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/doyensec/safeurl/security/advisories/GHSA-xgch-x3mx-cm3c"},{"type":"PACKAGE","url":"https://github.com/doyensec/safeurl"},{"type":"WEB","url":"https://github.com/doyensec/safeurl/releases/tag/v0.2.4"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-21T19:19:10.724316633Z"}}