AIKIDO-2026-596268

ip-address is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) Pre-CVE Published 3 days ago

Low Risk

This Affects:

ip-address

10.1.1 - 10.5.1

Fixed in 10.6.0

Are you affected? Scan for Free

TL;DR

Address4 and Address6 expose named special-use classifiers such as isPrivate(), isLoopback(), and isLinkLocal(). A guard written as an OR of those methods covers only the prefixes it names, and the IANA special-purpose registries contain more non-global ranges than there are classifier names. Addresses in 0.0.0.0/8, 192.0.0.0/24, 198.18.0.0/15, 240.0.0.0/4, the IPv4 documentation blocks, 2001::/23, 100::/64, 3fff::/20, and the deprecated site-local fec0::/10 therefore parse as well-formed and classify as unremarkable. Applications that use those classifiers for SSRF or trust-boundary filtering can be induced to treat a non-global destination as external. The fix adds isGlobal() on both classes, answering from registry-pinned tables (most specific Globally Reachable entry wins, with IPv6 also gated on the 2000::/3 global unicast allocation) and documents if (!address.isGlobal()) reject() as the intended guard.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you build network trust-boundary or SSRF filters from an OR of named classifiers such as isPrivate(), isLoopback(), and isLinkLocal() instead of a single globally-reachable check.