THREAT OPS › Threat News › [GHSA] GHSA-mwp4-54f8-5fhr (high) — ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
[GHSA] GHSA-mwp4-54f8-5fhr (high) — ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
GHSA-mwp4-54f8-5fhr Severity: high CVE: CVE-2026-69192
ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
### Summary
`Address4` accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, `inet_aton`, and `getaddrinfo` all decode a leading zero as octal. The libr
Indicators of compromise
- CVE-2026-69192cve
- http://012.0.0.1/url
- 012.0.0.1ipv4
- 12.0.0.1ipv4
- 012.012.012.012ipv4
- 12.12.12.12ipv4
- 010.0.0.1ipv4
- 8.0.0.1ipv4
- 010.010.010.010ipv4
- 10.0.0.0/8cidr
- 0.0.0.0/8cidr
Original source: https://github.com/advisories/GHSA-mwp4-54f8-5fhr