PT-2026-65085 · Ipaddress · Ipaddress

CVE-2026-54272

·

Published

2026-07-27

·

Updated

2026-07-27

CVSS v4.0

6.9

Medium

VectorAV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions ip-address versions 10.1.1 through 10.2.0
Description The library is susceptible to Server-Side Request Forgery (SSRF) due to the misclassification of IPv4-mapped and NAT64 IPv6 addresses. The Address6.getType() function classifies addresses by matching them against a table of known IPv6 special-use prefixes; however, the absence of an entry for the IPv4-mapped range (::ffff:0:0/96) causes these addresses to be incorrectly identified as Global unicast. Consequently, boolean checks such as isLoopback, isUnspecified, and isMulticast return false, while isLinkLocal and isULA only verify native IPv6 ranges. Because the library fails to normalize mapped or NAT64 addresses to their embedded IPv4 addresses using isMapped4() and to4() during these checks, the classification is bypassed. This is reachable on dual-stack hosts for IPv4-mapped addresses, while NAT64 bypasses require a NAT64/DNS64 gateway in the deployment network.
Recommendations Update ip-address to version 10.2.1.

Exploit

Fix

SSRF

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-54272
GHSA-22JQ-VG5J-6VGG

Affected Products

Ipaddress