CVE-2026-55245
2 advisories.
Go/github.com/maximhq/bifrost/core CVE-2026-55245: high, EPSS 0.61%
Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL
Action: Upgrade github.com/maximhq/bifrost/core to 1.5.17 or later.
go get github.com/maximhq/bifrost/core@v1.5.17Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.5.17 | - |
Fixed versions
| 1.5.17 |
Sources
- osv: GHSA-w98g-5w9p-p3rc
- https://github.com/maximhq/bifrost/security/advisories/GHSA-w98g-5w9p-p3rc
- https://github.com/maximhq/bifrost/pull/4092
- https://github.com/maximhq/bifrost/commit/54ec431fc5255ff42c36420d88549477e0b33d89
- https://github.com/maximhq/bifrost
- https://github.com/maximhq/bifrost/releases/tag/core/v1.5.17
CVE-2026-55245 · published · modified · JSON
Go/github.com/maximhq/bifrost/core CVE-2026-55245: unknown, EPSS 0.61%
Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL in github.com/maximhq/bifrost/core
Action: Upgrade github.com/maximhq/bifrost/core to 1.5.17 or later.
go get github.com/maximhq/bifrost/core@v1.5.17Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.5.17 | - |
Fixed versions
| 1.5.17 |
Sources
- osv: GO-2026-6320
- https://github.com/maximhq/bifrost/security/advisories/GHSA-w98g-5w9p-p3rc
- https://github.com/maximhq/bifrost/commit/54ec431fc5255ff42c36420d88549477e0b33d89
- https://github.com/maximhq/bifrost/pull/4092
- https://github.com/maximhq/bifrost/releases/tag/core/v1.5.17
CVE-2026-55245 · published · modified · JSON