{"id":"CVE-2026-73058","summary":"stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypass","details":"stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protections via the /proxy and /embed endpoints. Attackers can craft requests using IPv6 literal syntax to access services on the loopback interface and retrieve sensitive internal content.","aliases":["GHSA-4rmr-77qv-hq47"],"modified":"2026-08-19T03:31:14.470070991Z","published":"2026-08-16T13:14:05.977Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73058.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73058.json"},{"type":"ADVISORY","url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-4rmr-77qv-hq47"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73058"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/stoatchat-before-ssrf-via-ipv6-unspecified-address-bypass"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/stoatchat/stoatchat","events":[{"introduced":"0"},{"fixed":"a1628d7dd26c2388ef38f4a53714374729dec07c"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.15.0"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v0.14.3","v0.14.2","v0.14.1","v0.14.0","v0.13.7","v0.13.6","v0.13.5","v0.13.4","v0.13.3","v0.13.2","v0.13.1","v0.13.0","v0.12.1","v0.12.0","delete","v0.11.5","v0.11.4","v0.11.3","v0.11.2","v0.11.1","v0.11.0","v0.10.3","v0.10.2","v0.10.1","v0.10.0","v0.9.4","v0.9.3","v0.9.2","v0.9.1","v0.9.0","20250923-6","20250923-5","20250923-3","20250923-2","20250923-1","20250818-1","20250807-1","20250730-1","v0.8.8","20250608-1","20250530-1","20250515-1","20250514-1","20250513-2","20250513-1","20250510-1","20250509-8","20250509-7","20250509-6","20250509-5","20250509-4","20250509-3","20250509-2","20250509-1","20250402-2","20250402-1","20250225-2","20250225-1","20250224-1","20250210-1","20241227-2","20241227-1","20241226-1","20241222-6","20241222-5","20241222-4","20241222-3","20241222-2","20241222-1","20241220-1","20241213-1","20241212-1","20241128-3","20241128-2","20241128-1","20241024-1","20241002-7","20241002-6","20241002-5","20241002-4","20241002-3","20241002-2","20241002-1","20241001-1","20240929-3","20240929-2","20240929-1","20240909-2","20240909-1","20240830-1","20240829-3","20240829-2","20240829-1","20240805-1","20240710-1","20240629-1","20240626-1","20240625-2","20240625-1","20240623-1","20240621-1","20240620-2","20240620-1","20240619-1","20240615-1","20240611-3","20240611-2","20240611-1","20240609-1","20240604-1","20240516-1","20240408-4","20240408-3","20240408-2","20240408-1","20240407-1","20240212-1","20240210-2","20240210-1","20240206-1","20231028-2","20231028-1","20231026-01","20230905-1-beta","20230903-2-beta","20230903-1-beta","20230827-3-beta","20230827-2-beta","20230827-1-beta","20230826-1","20230810-3","20230810-2","20230810-1","20230704-1","20230702-1","20230615-1","20230611-5","20230611-4","20230611-3","20230611-2","20230611-1","20230604-1","20230603-3","20230603-2","20230603-1","20221119-1","20221023-2","20221023-1","20220918-2","20220918-1","20220912-1","20220903-1","20220902-1","20220901-1","20220814-1","20220726-1","20220718-1","20220715-1","0.5.5","20220714-1","20220710-1","0.5.4","20220623-1","20220621-1","20220620-1","20220614-1","20220612-4","20220612-3","20220612-2","20220612-1","20220611-1","20220610-2","20220610-1","20220609-1","20220606-1","0.5.3-5-patch.3","0.5.3-5-patch.2","0.5.3-5-patch.1","0.5.3-5","0.5.3-4","0.5.3-3","0.5.3-2","0.5.3-1","0.5.3-patch.2","0.5.3-patch.1","0.5.3","0.5.3-rc.5","0.5.3-rc.4","0.5.3-rc.3","0.5.3-rc.2","0.5.3-rc.1","0.5.3-alpha.16","0.5.3-alpha.15","0.5.3-alpha.14","0.5.3-alpha.13","0.5.3-alpha.11","0.5.3-alpha.10","0.5.3-alpha.9","0.5.3-alpha.8","0.5.3-alpha.7","0.5.3-alpha.6","0.5.0","0.4.1","0.4.0","0.3.3","0.3.3-alpha.7","0.3.3-alpha.6","0.3.3-alpha.5","0.3.3-alpha.4","0.3.3-alpha.3","0.3.3-alpha.2","0.3.3-alpha.1","0.3.3-alpha.0","0.3.2","0.3.1","0.3.0-rc.0","0.3.0","0.2.10","0.2.9","0.2.8","0.2.7","0.2.6","0.2.5","0.2.0","0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73058.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"}]}