CVE-2026-28681
2 advisories.
PyPI/irrd CVE-2026-28681: high 8.1, EPSS 0.59%
IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links
Action: Upgrade irrd to 4.4.5 or later.
pip install irrd==4.4.5pip install irrd==4.5.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.4.0 | 4.4.5 | - |
| 4.5.0 | 4.5.1 | - |
Fixed versions
| 4.4.5 | 4.5.1 |
Sources
- osv: GHSA-22m3-c7vp-49fj
- https://github.com/irrdnet/irrd/security/advisories/GHSA-22m3-c7vp-49fj
- https://nvd.nist.gov/vuln/detail/CVE-2026-28681
- https://github.com/irrdnet/irrd/commit/8408e0f1b9f47eb2f2e712d6153e32194df05fbb
- https://github.com/irrdnet/irrd/commit/cf62df4a49d3891e80b2879d9b324d1af050000c
- https://github.com/irrdnet/irrd
- https://irrd.readthedocs.io/en/stable/releases/4.4.5
- https://irrd.readthedocs.io/en/stable/releases/4.5.1
CVE-2026-28681 · published · modified · JSON
PyPI/irrd CVE-2026-28681: high 8.1, EPSS 0.59%
Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and from version 4.5.0 to before version 4.5
Action: Upgrade irrd to 4.4.5 or later.
pip install irrd==4.4.5pip install irrd==4.5.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.4.0 | 4.4.5 | - |
| 4.5.0 | 4.5.1 | - |
Fixed versions
| 4.4.5 | 4.5.1 |
Sources
- osv: PYSEC-2026-2186
- https://github.com/irrdnet/irrd/security/advisories/GHSA-22m3-c7vp-49fj
- https://irrd.readthedocs.io/en/stable/releases/4.4.5
- https://irrd.readthedocs.io/en/stable/releases/4.5.1
- https://github.com/irrdnet/irrd/commit/8408e0f1b9f47eb2f2e712d6153e32194df05fbb
- https://github.com/irrdnet/irrd/commit/cf62df4a49d3891e80b2879d9b324d1af050000c
CVE-2026-28681 · published · modified · JSON