Back
CVE-2026-110240
Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP
Medium6.3EPSS 0.33%
- Published
- Updated
- Reserved
- Assigned by
- VulnCheck
Description
Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding internal IPv4, to reach internal services or cloud metadata endpoints.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulnCheckCNA (assigner) | 4.0 | Medium6.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
| VulnCheckCNA (assigner) | 3.1 | Medium4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
| NVDNVD · Awaiting Analysis | 4.0 | Medium6.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.33% · top 74% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.
Weakness
Affected products
References (7)
- https://github.com/duke-git/lancet/issues/356 (opens in a new tab)issue-trackingtechnical-descriptionexploit
- https://github.com/duke-git/lancet/pull/357 (opens in a new tab)patchissue-tracking
- https://github.com/duke-git/lancet/commit/835111c832939a85416d686a1e99d5fe7060c9b4 (opens in a new tab)patch
- https://github.com/duke-git/lancet/blob/v2.3.9/netutil/net.go#L192-L205 (opens in a new tab)technical-description
- https://github.com/duke-git/lancet/blob/v1.4.6/netutil/net.go#L158-L170 (opens in a new tab)technical-description
- https://github.com/duke-git/lancet (opens in a new tab)product
- VulnCheck Advisory: Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP (opens in a new tab)third-party-advisory
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-110240)Record last updated .