https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 06 Aug 2026 21:54:30 +0000 https://vulnerability.circl.lu/sighting/c092738d-75a5-4ddf-a755-0dba02c59769/export {"uuid": "c092738d-75a5-4ddf-a755-0dba02c59769", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54272", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3msaxo5vln42v", "content": "\n\ud83d\udea8 New MEDIUM CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-54272 impacts ip-address in 2 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/642\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-08-04T12:00:56.407722Z"} {"uuid": "c092738d-75a5-4ddf-a755-0dba02c59769", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54272", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3msaxo5vln42v", "content": "\n\ud83d\udea8 New MEDIUM CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-54272 impacts ip-address in 2 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/642\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-08-04T12:00:56.407722Z"} https://vulnerability.circl.lu/sighting/c092738d-75a5-4ddf-a755-0dba02c59769/export Tue, 04 Aug 2026 12:00:56 +0000 https://vulnerability.circl.lu/sighting/2bd49c3d-4ffb-4b3b-ad7e-b6be49cb9c2f/export {"uuid": "2bd49c3d-4ffb-4b3b-ad7e-b6be49cb9c2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54272", "type": "seen", "source": "https://gist.github.com/alon710/539d26ece962aef59230f2218cc50bae", "content": "# CVE-2026-54272: CVE-2026-54272: SSRF and Trust-Boundary Bypass via Input Misclassification in ip-address Library\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54272\n\n## Summary\nA trust-boundary bypass and Server-Side Request Forgery (SSRF) vulnerability exists in the ip-address library versions 10.1.1 through 10.2.0 due to structural input misclassification. The library fails to resolve and normalize transition IP notations, such as IPv4-mapped IPv6 (::ffff:0:0/96) and NAT64 (64:ff9b::/96) addresses, to their embedded IPv4 representations prior to evaluation. Consequently, standard security validation checks (e.g., isLoopback, isLinkLocal, isULA) return false for these addresses. This allows remote attackers to bypass application-level IP address filters, gaining unauthorized access to internal resources, cloud metadata interfaces, and local services on dual-stack hosts or environments utilizing NAT64 gateways.\n\n## TL;DR\nInput misclassification in ip-address library <= 10.2.0 enables SSRF. The parser fails to normalize IPv4-mapped or NAT64 transition addresses before running boolean classification checks (e.g., isLoopback). This allows attackers to bypass security guards and connect to restricted internal IPv4 destinations over dual-stack host configurations.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918, CWE-20\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00254 (0.25%)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications incorporating npm package ip-address for IP validation\n- Dual-stack host configurations running vulnerable validation services\n- Environments utilizing NAT64/DNS64 translations with permissive HTTP proxies\n- **ip-address**: >= 10.1.1, <= 10.2.0 (Fixed in: `10.2.1`)\n\n## Mitigation\n\n- Upgrade dependency trees immediately to ip-address version 10.2.1 or newer.\n- Implement DNS lookup resolution first and validate the resolved IP addresses directly.\n- Deploy WAF rules to detect and drop transition IP notations at the perimeter.\n- Ensure HTTP clients establish connections directly to validated IP addresses rather than raw hostnames to prevent DNS Rebinding.\n\n**Remediation Steps:**\n1. Update your project dependencies: run 'npm install ip-address@10.2.1' or verify nested occurrences via dependency locking tools.\n2. Refactor backend validation logic to check ip.isPrivate() and ip.isLoopback() on parsed instances.\n3. Ensure to address-pin HTTP client configurations using the resolved IP address while overriding the HTTP Host header.\n\n## References\n\n- [GHSA-22jq-vg5j-6vgg: SSRF bypass through transition addresses](https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg)\n- [Fix implementation commit](https://github.com/beaugunderson/ip-address/commit/e86ab3e19588761ce18caf4820b26f01ac25043b)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54272) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T10:32:20.331358Z"} {"uuid": "2bd49c3d-4ffb-4b3b-ad7e-b6be49cb9c2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54272", "type": "seen", "source": "https://gist.github.com/alon710/539d26ece962aef59230f2218cc50bae", "content": "# CVE-2026-54272: CVE-2026-54272: SSRF and Trust-Boundary Bypass via Input Misclassification in ip-address Library\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54272\n\n## Summary\nA trust-boundary bypass and Server-Side Request Forgery (SSRF) vulnerability exists in the ip-address library versions 10.1.1 through 10.2.0 due to structural input misclassification. The library fails to resolve and normalize transition IP notations, such as IPv4-mapped IPv6 (::ffff:0:0/96) and NAT64 (64:ff9b::/96) addresses, to their embedded IPv4 representations prior to evaluation. Consequently, standard security validation checks (e.g., isLoopback, isLinkLocal, isULA) return false for these addresses. This allows remote attackers to bypass application-level IP address filters, gaining unauthorized access to internal resources, cloud metadata interfaces, and local services on dual-stack hosts or environments utilizing NAT64 gateways.\n\n## TL;DR\nInput misclassification in ip-address library <= 10.2.0 enables SSRF. The parser fails to normalize IPv4-mapped or NAT64 transition addresses before running boolean classification checks (e.g., isLoopback). This allows attackers to bypass security guards and connect to restricted internal IPv4 destinations over dual-stack host configurations.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918, CWE-20\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00254 (0.25%)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications incorporating npm package ip-address for IP validation\n- Dual-stack host configurations running vulnerable validation services\n- Environments utilizing NAT64/DNS64 translations with permissive HTTP proxies\n- **ip-address**: >= 10.1.1, <= 10.2.0 (Fixed in: `10.2.1`)\n\n## Mitigation\n\n- Upgrade dependency trees immediately to ip-address version 10.2.1 or newer.\n- Implement DNS lookup resolution first and validate the resolved IP addresses directly.\n- Deploy WAF rules to detect and drop transition IP notations at the perimeter.\n- Ensure HTTP clients establish connections directly to validated IP addresses rather than raw hostnames to prevent DNS Rebinding.\n\n**Remediation Steps:**\n1. Update your project dependencies: run 'npm install ip-address@10.2.1' or verify nested occurrences via dependency locking tools.\n2. Refactor backend validation logic to check ip.isPrivate() and ip.isLoopback() on parsed instances.\n3. Ensure to address-pin HTTP client configurations using the resolved IP address while overriding the HTTP Host header.\n\n## References\n\n- [GHSA-22jq-vg5j-6vgg: SSRF bypass through transition addresses](https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg)\n- [Fix implementation commit](https://github.com/beaugunderson/ip-address/commit/e86ab3e19588761ce18caf4820b26f01ac25043b)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54272) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T10:32:20.331358Z"} https://vulnerability.circl.lu/sighting/2bd49c3d-4ffb-4b3b-ad7e-b6be49cb9c2f/export Tue, 04 Aug 2026 10:32:20 +0000 https://vulnerability.circl.lu/sighting/31351630-64f0-48e2-a8f3-c98df169fba8/export {"uuid": "31351630-64f0-48e2-a8f3-c98df169fba8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54272", "type": "published-proof-of-concept", "source": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg", "content": "", "creation_timestamp": "2026-08-03T20:35:09.543269Z"} {"uuid": "31351630-64f0-48e2-a8f3-c98df169fba8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54272", "type": "published-proof-of-concept", "source": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg", "content": "", "creation_timestamp": "2026-08-03T20:35:09.543269Z"} https://vulnerability.circl.lu/sighting/31351630-64f0-48e2-a8f3-c98df169fba8/export Mon, 03 Aug 2026 20:35:09 +0000