Medium severity · published Oct 13, 2026
CVE-2026-110240
Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP
4.8
CVSS
0.3%
EPSS
No
On KEV
Description
Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding internal IPv4, to reach internal services or cloud metadata endpoints.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
lancet · duke-git
2.1.2 through 2.3.9; 1.3.1 through 1.4.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110240
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110240
issue-tracking
https://github.com/duke-git/lancet/issues/356
patch
https://github.com/duke-git/lancet/pull/357
patch
https://github.com/duke-git/lancet/commit/835111c832939a85416d686a1e99d5fe7060c9b4
technical-description
https://github.com/duke-git/lancet/blob/v2.3.9/netutil/net.go#L192-L205
technical-description
https://github.com/duke-git/lancet/blob/v1.4.6/netutil/net.go#L158-L170
product
https://github.com/duke-git/lancet