CVE-2026-54452: safeurl Library SSRF Vulnerability

CVE-2026-54452 Overview

CVE-2026-54452 affects safeurl, a Go library from Doyensec that provides Server-Side Request Forgery (SSRF) protection by filtering outbound HTTP destinations. Versions prior to 0.2.4 omit four IPv6 ranges from the privateNetworks list in ip.go: 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 via EnableIPv6(true), attacker-controlled destinations within these ranges bypass the SSRF destination check. This allows requests to resources that should be treated as non-public. IPv6 is disabled by default, so applications retaining EnableIPv6(false) are not exposed. The issue is fixed in version 0.2.4.

Critical Impact
Applications using safeurl with IPv6 enabled can be coerced into contacting hosts in four reserved IPv6 ranges, undermining SSRF protection and potentially exposing internal or translation-hosted resources [CWE-918].

Affected Products

doyensec/safeurl versions prior to 0.2.4
Go applications embedding safeurl with EnableIPv6(true)
Downstream services relying on safeurl for outbound URL validation

Discovery Timeline

2026-09-14 - CVE-2026-54452 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-54452

Vulnerability Analysis

The vulnerability is a Server-Side Request Forgery filter bypass rooted in an incomplete allowlist/denylist of reserved IPv6 prefixes. safeurl maintains a privateNetworks slice in ip.go containing CIDR ranges that must be rejected before an outbound request is issued. Four IANA-registered special-purpose IPv6 prefixes were absent from this list: 64:ff9b:1::/48 (IPv4/IPv6 translation), 5f00::/16 (Segment Routing SRv6 SIDs), 3fff::/20 (documentation), and 100:0:0:1::/64 (Dummy prefix).

Because the destination validator returns "public" for any address not matched by the list, requests targeting hosts in the omitted prefixes proceed to the HTTP client. In deployments enabling IPv6, an attacker who controls a URL parameter can steer the fetch toward these ranges. This is particularly relevant for 64:ff9b:1::/48, which is used by NAT64 translators and can route to arbitrary IPv4 destinations behind a translation gateway.

Root Cause

The privateNetworks list in ip.go sourced its IPv6 entries from an earlier snapshot of the IANA IPv6 Special-Purpose Address Registry. Newer registry entries were never propagated into the library, leaving the SSRF check incomplete when IPv6 was enabled.

Attack Vector

An unauthenticated remote attacker submits a URL whose hostname resolves to an address inside one of the omitted IPv6 prefixes, or supplies a literal IPv6 address in that range. The safeurl client accepts the destination as public and issues the request on behalf of the server, returning response data or side effects to the attacker.

// Patch excerpt from ip.go adding the missing IPv6 ranges
// Source: https://github.com/doyensec/safeurl/commit/d8f1021ea535b276f92999f0ec865da40e467016
parseCIDR("::/128"),         /* Unspecified Address - RFC 4291 */
parseCIDR("::1/128"),        /* Loopback - RFC 4291 */
parseCIDR("100::/64"),       /* Discard prefix - RFC 6666 */
parseCIDR("2001::/23"),      /* IETF Protocol Assignments - RFC 2928 */
parseCIDR("2001:2::/48"),    /* Benchmarking - RFC 5180 */
parseCIDR("2001:db8::/32"),  /* Documentation - RFC 3849 */
parseCIDR("2001::/32"),      /* Teredo - RFC 4380 */
parseCIDR("fc00::/7"),       /* Unique local - RFC 4193 */
parseCIDR("fe80::/10"),      /* Link-local - RFC 4291 */
parseCIDR("ff00::/8"),       /* Multicast - RFC 3513 */
parseCIDR("2002::/16"),      /* 6to4 - RFC 3056 */
parseCIDR("64:ff9b::/96"),   /* IPv4/IPv6 translation - RFC 6052 */
parseCIDR("64:ff9b:1::/48"), /* IPv4-IPv6 Translation - newly added */

Detection Methods for CVE-2026-54452

Indicators of Compromise

Outbound HTTP requests from application servers to destinations within 64:ff9b:1::/48, 5f00::/16, 3fff::/20, or 100:0:0:1::/64.
User-supplied URL parameters containing IPv6 literals mapped into the four omitted prefixes.
Application logs showing safeurl client requests succeeding to unusual IPv6 targets.

Detection Strategies

Inventory Go builds for github.com/doyensec/safeurl at versions below 0.2.4 using go list -m all or software composition analysis tooling.
Instrument the HTTP transport wrapping safeurl to log resolved destination IPs and alert on matches to the four omitted CIDRs.
Add web application firewall or reverse-proxy rules that reject request parameters containing IPv6 literals in the affected prefixes.

Monitoring Recommendations

Correlate outbound DNS resolutions returning AAAA records inside the four ranges with the originating HTTP request path.
Track configuration changes that flip EnableIPv6 to true in services depending on safeurl.
Baseline outbound IPv6 traffic from application tiers and alert on new destinations outside expected upstream services.

How to Mitigate CVE-2026-54452

Immediate Actions Required

Upgrade github.com/doyensec/safeurl to v0.2.4 and rebuild all dependent services.
Audit all safeurlConfig instantiations for EnableIPv6(true) and treat those services as priority upgrade targets.
Block egress traffic to 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64 at the network boundary until patched builds are deployed.

Patch Information

The fix is delivered in GitHub Release v0.2.4 via Pull Request #12 and commit d8f1021. Details are documented in the GitHub Security Advisory GHSA-xgch-x3mx-cm3c.

Workarounds

Set EnableIPv6(false) in the safeurl configuration, which is the default and is not affected by this bypass.
Add the four missing prefixes to a custom denylist via SetAllowedIPs/SetBlockedIPs if immediate upgrade is not possible.
Restrict outbound network policy on the host or container to permit only known upstream destinations.

bash

# Update the module to the patched release
go get github.com/doyensec/safeurl@v0.2.4
go mod tidy
go build ./...