CVE-2026-110240
Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP
duke-git lancet
CVSS
6.3MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 13 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.33%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding internal IPv4, to reach internal services or cloud metadata endpoints.
Text from CVE List
Affected versions 2
- lancetaffected: 2.1.2 through 2.3.9CVE List
- lancetaffected: 1.3.1 through 1.4.6CVE List
References 7
- github.com/duke-git/lancet/pull/357Fixvia CVE List
- github.com/duke-git/lancet/commit/835111c832939a85416d686a1e99d5fe7060c9b4Fixvia CVE List
- vulncheck.com/advisories/lancet-through-2.3.9-ssrf-protection-bypass-via-netutil-isinternalipAdvisoryvia CVE List
- github.com/duke-git/lancet/issues/356Exploitvia CVE List
- github.com/duke-git/lancet/blob/v2.3.9/netutil/net.go#L192-L205Referencevia CVE List
- github.com/duke-git/lancet/blob/v1.4.6/netutil/net.go#L158-L170Referencevia CVE List
- github.com/duke-git/lancetReferencevia CVE List