CVE-2026-75856CWE-918ssrf

CVE-2026-75856

High · published August 18, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
41.5
In the wild
Unconfirmed
What it is

CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00495 · 41.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-18T20:18Z
References (4)
https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e · [email protected]https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmh · [email protected]https://www.vulncheck.com/advisories/codewhale-before-ssrf-bypass-via-dns-pinning-toctou · [email protected]https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmh · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 AUG 15:21Z
    CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU
    cvelistv5