---
id: CVE-2026-54452
title: safeurl is a server-side request forgery protection library
summary: >-
  safeurl is a server-side request forgery protection library. Prior to 0.2.4,
  the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48,
  5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6
  with EnableIP…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'
cwe:
  - CWE-918
vendor: doyensec
product: safeurl
affected:
  - safeurl < 0.2.4
patched:
  - github.com/doyensec/safeurl 0.2.4
published: '2026-09-14'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T16:17:08.760'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54452'
references:
  - url: >-
      https://github.com/doyensec/safeurl/commit/d8f1021ea535b276f92999f0ec865da40e467016
    label: security-advisories@github.com
  - url: 'https://github.com/doyensec/safeurl/pull/12'
    label: security-advisories@github.com
  - url: 'https://github.com/doyensec/safeurl/releases/tag/v0.2.4'
    label: security-advisories@github.com
  - url: >-
      https://github.com/doyensec/safeurl/security/advisories/GHSA-xgch-x3mx-cm3c
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-xgch-x3mx-cm3c'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
epss: 0.00521
epssPercentile: 0.41789
aliases:
  - GHSA-xgch-x3mx-cm3c
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-16T15:16:34.102550Z'
cvssSource: cna
ingestedAt: '2026-07-15T22:46:58.908Z'
---

## Overview

safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6(true), an attacker-controlled destination in one of these ranges is not recognized as non-public and can pass the SSRF destination check, potentially allowing access to resources hosted within the omitted ranges. IPv6 is disabled by default, and configurations that retain EnableIPv6(false) are not exposed to this bypass. This issue is fixed in version 0.2.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54452)

Affected packages:

- `github.com/doyensec/safeurl < 0.2.4`

Patched in:

- `github.com/doyensec/safeurl 0.2.4`

Source: https://github.com/advisories/GHSA-xgch-x3mx-cm3c