CVE-2026-48737
Received Received - Intake

IPv6 Address Handling Flaw in pyLoad

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src/pyload/core/utils/web/check.py relies on Python's global-address classification without examining IPv4 destinations embedded in 6to4 or NAT64 IPv6 addresses. A low-privileged user can submit an IPv6 literal through parse_urls to the pre-resolution is_global_host guard. Because host_to_ip is pinned to AF_INET, that guard does not evaluate a hostname's AAAA result. Separately, curl resolves hostnames before the pycurl PREREQFUNC in src/pyload/core/network/http/http_request.py applies the same vulnerable is_global_address check to the actual connection address, so a transition-form AAAA result can be permitted even when it terminates at an embedded loopback, private, CGNAT, or link-local IPv4 address. Exploitation requires the pyLoad host to route the applicable transition mechanism, including 6to4 on affected Python 3.9 through 3.11 deployments or NAT64 on a network with a NAT64 gateway. Successful exploitation can enable internal-network reconnaissance, timing-based confirmation, limited service disruption, or cloud metadata disclosure where the wrapped address is routable. This issue is fixed in version 0.5.0b3.dev101.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-48737
EUVD
EUVD-2026-78593

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
pyload pyload 0.5.0b3.dev101
pyload pyload From 3.9 (inc) to 3.11 (inc)
pyload pyload to 0.5.0b3.dev100 (exc)
pyload pyload From 0.5.0b3.dev101 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in pyLoad versions up to 0.5.0b3.dev100. It occurs because the SSRF protection mechanism incorrectly classifies IPv6 transition addresses (6to4 and NAT64) as globally routable. Attackers can bypass SSRF protections by submitting IPv6 addresses that embed internal IPv4 addresses like loopback or private ranges.

Detection Guidance

Detecting this vulnerability requires checking if your pyLoad instance is running a vulnerable version (<0.5.0b3.dev101) and if IPv6 transition addresses (6to4 or NAT64) are being processed. Inspect logs for IPv6 addresses in download requests or parse_urls output. Use network monitoring tools to check for 6to4 or NAT64 traffic routing.

Impact Analysis

Exploitation can enable internal network reconnaissance, timing-based confirmation of internal services, limited service disruption, or cloud metadata disclosure if the embedded IPv4 address is routable. This requires the pyLoad host to route 6to4 or NAT64 traffic.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized network reconnaissance or data exfiltration through SSRF attacks. If exploited, it may allow access to internal services or cloud metadata endpoints, which could lead to violations of data protection requirements under these regulations.

Mitigation Strategies

Upgrade pyLoad to version 0.5.0b3.dev101 or later immediately. If upgrading is not possible, disable IPv6 support in pyLoad or block 6to4/NAT64 traffic at the network level. Review and restrict user permissions to limit SSRF impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48737. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart