CVE-2026-110240

Awaiting Analysis Awaiting Analysis - Queue

SSRF Bypass in Lancet via IPv6 Address Misclassification

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description

Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding internal IPv4, to reach internal services or cloud metadata endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110240

EUVD

EUVD-2026-99024

Affected Vendors & Products

Vendor	Product	Version / Range
duke-git	lancet	2.1.2
duke-git	lancet	1.3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-110240 is an SSRF protection bypass vulnerability in the Lancet library versions 2.1.2 through 2.3.9 and 1.3.1 through 1.4.6. The issue is in the netutil.IsInternalIP function, which incorrectly classifies certain IPv6 and IPv6-transition-wrapped IPv4 addresses as external when they should be internal. This includes IPv6 private, link-local, CGNAT, and transition addresses like NAT64, 6to4, or Teredo.

Detection Guidance

To detect this vulnerability, check if your Lancet library version is between 2.1.2-2.3.9 or 1.3.1-1.4.6. Review network logs for SSRF attempts targeting internal services or cloud metadata endpoints using IPv6 private, link-local, CGNAT, or transition addresses like NAT64, 6to4, or Teredo.

Impact Analysis

Attackers can exploit this vulnerability by supplying hostnames that resolve to misclassified internal IPv6 or transition addresses. This may allow them to bypass SSRF protections and access internal services or cloud metadata endpoints that should be restricted.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized access to internal services or cloud metadata endpoints. Misclassification of internal IPv6 and transition addresses as external may lead to insufficient SSRF protections, potentially exposing sensitive data or systems to attackers. This could violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., Security Rule safeguards for ePHI).

Mitigation Strategies

Upgrade Lancet to a patched version where IsInternalIP correctly classifies IPv6 and transition addresses. If upgrading is not possible, implement network-level SSRF protections to block requests to internal IP ranges and cloud metadata endpoints.

Hi! I’m here to help you understand CVE-2026-110240. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70