Paranoidhttp Server-Side Request Forgery vulnerability

ALTO 7.5CVE-2023-24623 · GHSA-v9mp-j8g7-2q6m · GO-2023-1526 · Published 30/01/2023 · updated 17/06/2026

In breve

CVE-2023-24623 è una vulnerabilità ALTO (CVSS 7.5) che riguarda github.com/hakobe/paranoidhttp, paranoidhttp (paranoidhttp project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.68%, superiore al 52.8% delle vulnerabilità.
Correzione: aggiornare a 0.3.0 o successiva.

Package	Affected versions	Patched versions
github.com/hakobe/paranoidhttp Go	`< 0.3.0`	`0.3.0`
paranoidhttp paranoidhttp_project	`< 0.3.0`	`0.3.0`

Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.

NVD description

Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.