Skip to content

v0.8.29 — SSRF egress guard (CVE-2026-47390)

Choose a tag to compare

View all tags
@sattyamjjain sattyamjjain released this 21 Jun 15:04
v0.8.29
157dd14
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

feat(guard): deny-by-default SSRF egress guard for the alternate-encoding / rebinding bypass class (CVE-2026-47390)

Closes the SSRF-protection-bypass class (CWE-918, OWASP ASI02): an egress filter that validates the literal hostname string of an outbound URL — instead of the resolved IP — is bypassed by encoding loopback / link-local / cloud-metadata in a form ipaddress rejects but the HTTP client connects to, or by DNS rebinding.

  • SSRFEgressGuard (ssrf_egress_guard.py) reduces every target to its canonical IP(s) — decoding 127.1 / decimal 2130706433 / octal 0177.0.0.1 / hex 0x7f000001 / 0.0.0.0 / IPv6 ::1 / ::ffff:127.0.0.1 / 0:0:0:0:0:0:0:1 via socket.inet_aton, and resolving hostnames at check time so a rebind to loopback/metadata is caught at connect time — and fails closed on any loopback / link-local (incl. 169.254.169.254 IMDS) / metadata / unspecified / RFC1918 range not on allow_internal_hosts. 3-line explain audit trace (rule / resolved IP / encoding) on every denial. Composes with the v0.5.5 network.is_blocked_ipv6_range set. Never opens a socket.
  • New SSRFEgressDecision / SSRFEgressVerdict / SSRFEgressBlocked.
  • policy_presets.ssrf_egress_guard_defaults(allow_internal_hosts=…) — STANDARD egress posture (preset_id=ssrf_egress_guard, severity=high, owasp=ASI02, cwe=(CWE-918,), cves=(CVE-2026-47390,)).
  • 34 tests; built-wheel smoke confirms http://0x7f000001/ and http://169.254.169.254/ are denied. Pydantic-only core, no new runtime deps. (#97)

Source: https://www.cve.org/CVERecord?id=CVE-2026-47390

Assets 2
Loading