GHSA-xgch-x3mx-cm3c

Source

https://github.com/advisories/GHSA-xgch-x3mx-cm3c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-xgch-x3mx-cm3c/GHSA-xgch-x3mx-cm3c.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xgch-x3mx-cm3c

Aliases

Published

2026-07-15T21:58:03Z

Modified

2026-07-21T19:19:10Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

safeurl is Missing IPv6 CIDR Ranges in Blocklist

Details

The privateNetworks blocklist was found to be missing newly added CIDR ranges. More specifically, the following CIDR ranges were not being blocked:

64:ff9b:1::/48: NAT64 local-use prefix (RFC 8215)
5f00::/16: Segment Routing (SRv6) SIDs (RFC 9602)
3fff::/20: documentation prefix (RFC 9637)
100:0:0:1::/64: Dummy IPv6 Prefix (RFC 9780)

Impact

If exploited, an attacker would potentially be able to reach resources hosted on the IPs residing in the missing ranges.

Workarounds

Disable IPv6 by setting EnableIPv6(false). This is the default behavior of the library.

Resolution

Upgrade to v0.2.4

Credits

safeurl thanks @tonghuaroot for reporting.

Database specific

{
    "cwe_ids": [
        "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-15T21:58:03Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

Go / github.com/doyensec/safeurl

Package

Name: github.com/doyensec/safeurl; View open source insights on deps.dev
Purl: pkg:golang/github.com/doyensec/safeurl

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.2.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-xgch-x3mx-cm3c/GHSA-xgch-x3mx-cm3c.json"