CVE-2026-110240

MediumCVSS 4.8/10Last modified Oct 13, 2026

Description

Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding internal IPv4, to reach internal services or cloud metadata endpoints.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 13, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1102439.9The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its lin CVE-2026-1102478.4Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message th CVE-2026-1102485.3Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 bef CVE-2026-1102498.6A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough CVE-2026-110256.5Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass content CVE-2026-1102525.4The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This CVE-2026-1102535.4The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to i CVE-2026-1102544.3Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety CVE-2026-1102558.5Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to ma CVE-2026-1102563.7Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts CVE-2026-1102575.5OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an i CVE-2026-1102585.5OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce th