CVE-2026-110240: Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP
Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding internal IPv4, to reach internal services or cloud metadata endpoints.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using Lancet’s netutil.IsInternalIP as an SSRF control are exposed if they allow attacker-influenced hostnames or destinations. The affected logic can treat IPv6 private, link-local, CGNAT, and transition addresses as external.
What does an attacker need to exploit this issue?
An attacker needs to be able to supply a hostname that the application resolves before making an outbound request. The hostname must resolve to a misclassified address form, including NAT64, 6to4, or Teredo addresses that embed an internal IPv4 address.
What can an attacker reach if exploitation succeeds?
The bypass can allow requests to internal services or cloud metadata endpoints that the SSRF protection was intended to block. The supplied severity vector indicates network-based exploitation without privileges or user interaction, but with high attack complexity.
How can teams identify potentially affected usage?
Review applications that depend on go/github.com/duke-git/lancet/v2 through version 2.3.9 and use netutil.IsInternalIP to approve outbound destinations. Test hostname resolution and destination validation against IPv6 private, link-local, CGNAT, NAT64, 6to4, and Teredo address forms.