PT-2026-65085 · Ipaddress · Ipaddress
CVE-2026-54272
·
Published
2026-07-27
·
Updated
2026-07-27
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
ip-address versions 10.1.1 through 10.2.0
Description
The library is susceptible to Server-Side Request Forgery (SSRF) due to the misclassification of IPv4-mapped and NAT64 IPv6 addresses. The
Address6.getType() function classifies addresses by matching them against a table of known IPv6 special-use prefixes; however, the absence of an entry for the IPv4-mapped range (::ffff:0:0/96) causes these addresses to be incorrectly identified as Global unicast. Consequently, boolean checks such as isLoopback, isUnspecified, and isMulticast return false, while isLinkLocal and isULA only verify native IPv6 ranges. Because the library fails to normalize mapped or NAT64 addresses to their embedded IPv4 addresses using isMapped4() and to4() during these checks, the classification is bypassed. This is reachable on dual-stack hosts for IPv4-mapped addresses, while NAT64 bypasses require a NAT64/DNS64 gateway in the deployment network.Recommendations
Update ip-address to version 10.2.1.
Exploit
Fix
SSRF
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ipaddress