Is CVE-2026-54452 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54452 being exploited in the wild.

How severe is CVE-2026-54452?

Medium severity, with a CVSS score of 4, published 14 September 2026.

Which products and versions are affected?

Doyensec Safeurl < 0.2.4; github.com/doyensec/safeurl (Go) < 0.2.4, SEMVER:introduced=0,fixed=0.2.4.

Is there a fix for CVE-2026-54452?

Yes. github.com/doyensec/safeurl (Go): upgrade to 0.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54452 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54452?

Check whether you run Doyensec Safeurl or github.com/doyensec/safeurl (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54452: Doyensec safeurl SSRF bypass via missing IPv6 CIDR ranges

Q: Which products and versions are affected?

Doyensec Safeurl < 0.2.4; github.com/doyensec/safeurl (Go) < 0.2.4, SEMVER:introduced=0,fixed=0.2.4.

Q: Is there a fix for CVE-2026-54452?

Yes. github.com/doyensec/safeurl (Go): upgrade to 0.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54452 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54452?

Check whether you run Doyensec Safeurl or github.com/doyensec/safeurl (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54452 · Severity: medium · CVSS 4 · Published 2026-09-14

A security library used to prevent Server-Side Request Forgery (SSRF) was found to have an incomplete list of blocked IPv6 addresses. This could allow an attacker to bypass security filters and access internal resources or restricted network services that were intended to be protected. Organizations using this library to validate user-provided URLs should update to the latest version to ensure all modern IPv6 ranges are correctly restricted.

Technologies: Doyensec Safeurl. Vendors: Doyensec, Go.

Quick answers

Is CVE-2026-54452 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54452 being exploited in the wild.
How severe is CVE-2026-54452?: Medium severity, with a CVSS score of 4, published 14 September 2026.
Which products and versions are affected?: Doyensec Safeurl < 0.2.4; github.com/doyensec/safeurl (Go) < 0.2.4, SEMVER:introduced=0,fixed=0.2.4.
Is there a fix for CVE-2026-54452?: Yes. github.com/doyensec/safeurl (Go): upgrade to 0.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54452 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54452?: Check whether you run Doyensec Safeurl or github.com/doyensec/safeurl (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/doyensec/safeurl (Go): upgrade to 0.2.4 or later
```
go get github.com/doyensec/safeurl@v0.2.4
```

Technical details

The safeurl library (github.com/doyensec/safeurl) is vulnerable to Server-Side Request Forgery (SSRF) bypass because its `privateNetworks` blocklist lacked several recently defined IPv6 CIDR ranges. Specifically, ranges defined in RFC 8215 (NAT64), RFC 9602 (SRv6 SIDs), RFC 9637 (documentation), and RFC 9780 (Dummy IPv6) were not included. An attacker can exploit this by providing a URL pointing to an IP within these ranges, which the library would fail to block. The vulnerability is remediated in version 0.2.4. A temporary workaround is to disable IPv6 support entirely using `EnableIPv6(false)`.

Affected products

Doyensec safeurl < 0.2.4

Identifiers

CVE-2026-54452
GHSA-xgch-x3mx-cm3c
GO-2026-5997

Timeline

2026-06-04: disclosed: Initial publication by maintainer
2026-07-15: advisory: GitHub Advisory published
2026-07-15: patched: Version 0.2.4 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.