{"id":"CVE-2026-55758","title":"CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game","summary":"CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java b…","severity":"none","cwe":["CWE-918"],"published":"2026-08-27","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55758","references":[{"url":"https://github.com/cc-tweaked/CC-Tweaked/commit/d1bfb2571d3bde55529fac50d8303b7404499ec0","label":"security-advisories@github.com"},{"url":"https://github.com/cc-tweaked/CC-Tweaked/security/advisories/GHSA-2rrx-mch2-76cp","label":"security-advisories@github.com"},{"url":"https://github.com/cc-tweaked/CC-Tweaked/security/advisories/GHSA-2rrx-mch2-76cp","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00427,"epssPercentile":0.36574,"ingestedAt":"2026-09-09T21:22:45.557Z","slug":"CVE-2026-55758","body":"## Overview\n\nCC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java blocks the RFC 6052 64:ff9b::/96 NAT64 prefix but omits the RFC 8215 64:ff9b:1::/48 local-use prefix. On a dual-stack server using RFC 8215 NAT64, an unauthenticated user who can execute Lua code can use http.request or http.websocket with an address under 64:ff9b:1::/48 to reach loopback, RFC 1918, cloud metadata, or internal API endpoints because PrivatePattern.matches() does not classify the mapped IPv6 address as private. This issue is fixed in version 1.120.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}