CVE-2026-108939

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108939
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108939.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108939
Published
2026-10-12T23:15:21Z
Modified
2026-10-14T02:47:07Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
EricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery
Details

A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function is_global_ip of the file mistralrs-server-core/src/media_source.rs. Such manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.9.4 is recommended to address this issue. The name of the patch is cfb8c6a0c42361dc4579a9110b54d339c255b9fd. The affected component should be upgraded.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108939.json"
}
References

Affected packages

Git / github.com/ericlbuehler/mistral.rs

Affected ranges

Type
GIT
Repo
https://github.com/ericlbuehler/mistral.rs
Events
Introduced
54957525b8b648108000af2004a4991cf08c0e69
Fixed
cfb8c6a0c
Fixed
cfb8c6a0c42361dc4579a9110b54d339c255b9fd
Fixed
4400935451da5e2dc7379a3f92fbbada66557f6c
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.9.0"
        },
        {
            "last_affected":  "0.9.0"
        },
        {
            "introduced":  "0.9.1"
        },
        {
            "last_affected":  "0.9.1"
        },
        {
            "introduced":  "0.9.2"
        },
        {
            "last_affected":  "0.9.2"
        },
        {
            "introduced":  "0.9.3"
        },
        {
            "last_affected":  "0.9.3"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.9.0
0.9.1
0.9.2
0.9.3
v0.*
v0.9.0
v0.9.1
v0.9.2
v0.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108939.json"