CWE-1327: Binding to an Unrestricted IP Address

Base

The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.

When a server binds to the address 0.0.0.0, it allows connections from every IP address on the local machine, effectively exposing the server to every possible network. This might be much broader access than intended by the developer or administrator, who might only be expecting the server to be reachable from a single interface/network.

Consequences

Availability: DoS: Amplification

How to prevent it

System Configuration: Assign IP addresses that are not 0.0.0.0.
System Configuration: Unwanted connections to the configured server may be denied through a firewall or other packet filtering measures.

Recent advisories

GHSA-86m2-fcxq-5q7c — 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF
GHSA-x227-pf99-vffg — PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
GHSA-525j-hqq2-66r4 — OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0
GHSA-qw99-grcx-4pvm — OpenClaw's Chrome extension relay binds publicly due to wildcard treated as loopback

All advisories for CWE-1327

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor