Skip to content
Log inStart free trial

CWE-918: Server-Side Request Forgery (SSRF)

Base

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Consequences

  • Confidentiality: Read Application Data
  • Integrity: Execute Unauthorized Code or Commands
  • Access Control: Bypass Protection Mechanism

Recent advisories

  • EEF-CVE-2026-115700 — SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney
  • GHSA-2wqp-q3c6-ccj5 — MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
  • GHSA-2phh-27fw-q4gc — PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
  • GHSA-p3pr-8f3m-4qp8 — pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
  • GHSA-j8f7-x8jm-wmm4 — Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)
  • GHSA-r7f2-6fj8-6fg2 — Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
  • GHSA-322m-ff4g-9vx9 — Ghost: Server-Side Request Forgery in Bookmark Fetching
  • GHSA-cjq9-62q9-8jv4 — Next.js has Server-Side Request Forgery in Image Optimization
  • GHSA-354h-gmhv-mr9c — Ghost: Server-Side Request Forgery in Webhook Trigger
  • GHSA-9v7f-9g4p-ffgj — PyJWT: PyJWKClient follows redirects when fetching JWKS
  • GHSA-rpw4-54j3-4h4q — ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
  • GHSA-2vr4-cq9g-pvrc — ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass
  • GHSA-3pq3-5fj3-cg6v — Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
  • CVE-2026-96655 — Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal'…
  • CVE-2026-96652 — Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'.

All advisories for CWE-918

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor