CVE-2026-54452: safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b

Executive brief

A security library used to prevent Server-Side Request Forgery (SSRF) was found to have an incomplete list of blocked IPv6 addresses. This could allow an attacker to bypass security filters and access internal resources or restricted network services that were intended to be protected. Organizations using this library to validate user-provided URLs should update to the latest version to ensure all modern IPv6 ranges are correctly restricted.

Technical details

The safeurl library (github.com/doyensec/safeurl) is vulnerable to Server-Side Request Forgery (SSRF) bypass because its `privateNetworks` blocklist lacked several recently defined IPv6 CIDR ranges. Specifically, ranges defined in RFC 8215 (NAT64), RFC 9602 (SRv6 SIDs), RFC 9637 (documentation), and RFC 9780 (Dummy IPv6) were not included. An attacker can exploit this by providing a URL pointing to an IP within these ranges, which the library would fail to block. The vulnerability is remediated in version 0.2.4. A temporary workaround is to disable IPv6 support entirely using `EnableIPv6(false)`.

Affected products

• Doyensec safeurl < 0.2.4

Timeline

• 2026-06-04: disclosed: Initial publication by maintainer
• 2026-07-15: advisory: GitHub Advisory published
• 2026-07-15: patched: Version 0.2.4 released

References

• https://api.github.com/users/tonghuaroot
• https://github.com/tonghuaroot
• https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D
• https://api.github.com/users/tonghuaroot/repos
• https://avatars.githubusercontent.com/u/23011166?v=4
• https://api.github.com/users/tonghuaroot/events%7B/privacy%7D