Go/github.com/gohugoio/hugo CVE-2026-58404: medium 6.8, EPSS 0.37%

Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF)

Action: Upgrade github.com/gohugoio/hugo to 0.163.1 or later.

go get github.com/gohugoio/hugo@v0.163.1

Affected

Fixed versions

Sources

• osv: GHSA-r46f-3rpw-hxrv
• nvd: CVE-2026-58404
• https://github.com/gohugoio/hugo/security/advisories/GHSA-r46f-3rpw-hxrv
• https://github.com/gohugoio/hugo

CVE-2026-58404 · published 2026-06-19T19:18:14Z · modified 2026-07-24T19:11:46.394705101Z · JSON