CVE-2026-73087
Received Received - Intake

IPv6 Address Embedding Bypass in Dozzle SSRF Guard

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeDialContext for webhook notification URLs, does not inspect IPv4 addresses embedded in 6to4, NAT64, Teredo, or IPv4-compatible IPv6 addresses, allowing an authenticated user to reach loopback or link-local targets that the guard intends to block. This issue is fixed in version 10.6.15.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-09-01
AI Q&A
2026-08-11
EPSS Evaluated
2026-08-30
NVD
CVE-2026-73087
EUVD
EUVD-2026-56556

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
dozzle dozzle From 10.5.2 (inc) to 10.6.15 (inc)
amir20 dozzle From 10.5.2 (inc) to 10.6.15 (inc)
amir20 dozzle 10.6.15

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Dozzle's webhook notification system. It occurs because the IP blocking mechanism fails to detect IPv6 transition addresses like 6to4, NAT64, and Teredo, which embed IPv4 addresses. Attackers can bypass security checks by crafting URLs with these transition formats to access blocked targets such as localhost or cloud metadata endpoints.

Detection Guidance

To detect this vulnerability, inspect Dozzle logs for webhook notifications targeting IPv6 transition addresses like 6to4 (2002::/16), NAT64 (64:ff9b::/96), or Teredo (2001::/32). Check for requests to loopback (127.0.0.1) or link-local (169.254.0.0/16) addresses embedded in these formats.

Impact Analysis

An authenticated user could exploit this to send requests to internal services or sensitive endpoints that should be blocked. While the response is not returned to the user, the attacker can infer success based on status codes, enabling semi-blind SSRF attacks. This could lead to unauthorized access to cloud metadata or internal applications.

Compliance Impact

This vulnerability does not directly impact GDPR or HIPAA compliance as it is a low-severity SSRF issue in Dozzle's webhook system. It allows bypassing IP blocking for loopback or link-local targets but does not expose sensitive data or violate data protection requirements.

Mitigation Strategies

Upgrade Dozzle to version 10.6.15 or later to apply the security fix for CVE-2026-73087. The update includes improved IP blocking for IPv6 transition addresses in the webhook dispatcher.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73087. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart