Skip to content

v0.8.32 — SafeURL IPv6-transition cloud-metadata SSRF (CVE-2026-48782)

Choose a tag to compare

View all tags
@sattyamjjain sattyamjjain released this 21 Jun 16:13
v0.8.32
88669cc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

feat(safeurl): block IPv6-transition-form cloud-metadata SSRF (CVE-2026-48782)

Extends the existing SafeURL / SafeURLValidator cloud-metadata blocklist to canonicalize the host to its packed ipaddress form before the comparison, closing the IPv6-transition / alternate-encoding SSRF bypass class (CWE-918). A metadata IP encoded as IPv4-mapped IPv6 (::ffff:169.254.169.254), IPv4-compatible (::169.254.169.254), 6to4 (2002:a9fe:a9fe::), Teredo, or a decimal/octal/hex integer (2852039166 / 0xa9fea9fe) previously slipped past the string blocklist while the HTTP client still reached IMDS. Closes the IPv6-transition gap left by the upstream fix of CVE-2026-46678.

  • New safe_types.metadata_ip_candidates(host) collapses every encoding (incl. the embedded IPv4 of each transition form) to packed form and compares against the canonical metadata-IP set (AWS/GCP/Azure 169.254.169.254/.253, AWS IPv6 fd00:ec2::254, Alibaba 100.100.100.200).
  • Additive only — public SafeURL signature unchanged; the check is on by default under block_metadata_urls=True, so every SafeURLValidator, the SafeURL/SafeURLAllowHttp Pydantic types, and presets using them inherit it.
  • 23 tests; built-wheel smoke confirms the SafeURL type rejects an IPv4-mapped-IPv6 metadata URL and legitimate public IPv6 still passes. Pydantic-only core, no new runtime deps. (#100)

Source: GHSA-cg7w-rg45-pc59

Assets 2
Loading