CVE-2026-110240

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110240
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110240.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110240
Published
2026-10-13T18:50:20Z
Modified
2026-10-14T10:46:56Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP
Details

Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding internal IPv4, to reach internal services or cloud metadata endpoints.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110240.json"
}
References

Affected packages

Git / github.com/duke-git/lancet

Affected ranges

Type
GIT
Repo
https://github.com/duke-git/lancet
Events
Introduced
068c878d1eed7e644c229c7bca1693631541d26e
Last Affected
cf1b27a35afd1e7047981b08c82ff530b61b8a82
Introduced
b6815224fdf4a08c0166fef2433fac837c39606c
Last Affected
69b34faeec6cd931ceaf121013327e68406f7c98
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.1.2"
        },
        {
            "last_affected":  "2.3.9"
        },
        {
            "introduced":  "1.3.1"
        },
        {
            "last_affected":  "1.4.6"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.3.8
v1.3.9
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v2.*
v2.1.10
v2.1.11
v2.1.12
v2.1.14
v2.1.15
v2.1.16
v2.1.17
v2.1.18
v2.1.19
v2.1.2
v2.1.20
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110240.json"