Is CVE-2026-108939 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108939 being exploited in the wild.

How severe is CVE-2026-108939?

Medium severity, with a CVSS score of 5.3, published 13 October 2026.

Which products and versions are affected?

EricLBuehler Mistral.Rs up to 0.9.3.

Is there a fix for CVE-2026-108939?

Yes: fixed in 0.9.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108939 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-108939?

Check whether you run EricLBuehler Mistral.Rs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108939: EricLBuehler mistral.rs server-side request forgery in is_global_ip

CVE-2026-108939 · Severity: medium · CVSS 5.3 · Published 2026-10-13

mistral.rs is a fast LLM inference framework. A vulnerability in the is_global_ip function allows remote attackers to bypass IP address validation and craft arbitrary requests to internal services, potentially leading to unauthorized access or data exposure through server-side request forgery.

Technologies: EricLBuehler Mistral.Rs. Vendors: EricLBuehler.

Quick answers

Is CVE-2026-108939 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108939 being exploited in the wild.
How severe is CVE-2026-108939?: Medium severity, with a CVSS score of 5.3, published 13 October 2026.
Which products and versions are affected?: EricLBuehler Mistral.Rs up to 0.9.3.
Is there a fix for CVE-2026-108939?: Yes: fixed in 0.9.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108939 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-108939?: Check whether you run EricLBuehler Mistral.Rs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.9.4

Technical details

The is_global_ip function in mistralrs-server-core/src/media_source.rs fails to properly validate IP addresses, allowing an attacker to manipulate the ip argument and trigger a server-side request forgery condition. The vulnerability is remotely exploitable without authentication and the attack vector involves sending crafted IP values that bypass the global IP check, particularly affecting IPv6 transition addresses.

Affected products

EricLBuehler mistral.rs up to 0.9.3

Timeline

2026-10-13: disclosed
2026-10-13: patched: patch cfb8c6a0c42361dc4579a9110b54d339c255b9fd

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.