{"cve":"CVE-2026-73087","nvd":{"published":"2026-08-11T17:19:16.830","modified":"2026-10-24T15:10:00.190","status":"Deferred","description":"Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeDialContext for webhook notification URLs, does not inspect IPv4 addresses embedded in 6to4, NAT64, Teredo, or IPv4-compatible IPv6 addresses, allowing an authenticated user to reach loopback or link-local targets that the guard intends to block. This issue is fixed in version 10.6.15.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":2.3},"cvss_v3":null,"cwes":["CWE-918"],"references":["https://github.com/amir20/dozzle/commit/8cf7ccd5ee041ecaea92b49951793d4d2393761f","https://github.com/amir20/dozzle/pull/4887","https://github.com/amir20/dozzle/releases/tag/v10.6.15","https://github.com/amir20/dozzle/security/advisories/GHSA-p2w3-6x73-2f6x","https://github.com/amir20/dozzle/security/advisories/GHSA-p2w3-6x73-2f6x"],"products":[],"source":"nvd","synced_at":"2026-10-24T16:53:35.584907681+00:00"},"epss":{"cve":"CVE-2026-73087","score":0.00465,"percentile":0.39993,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-p2w3-6x73-2f6x","url":"https://osv.dev/vulnerability/GHSA-p2w3-6x73-2f6x","summary":"Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher","modified":"2026-09-10T15:25:38.174100153Z","packages":[{"ecosystem":"Go","name":"github.com/amir20/dozzle","purl":"pkg:golang/github.com/amir20/dozzle","ranges":["<1.29.1-0.20260804193351-8cf7ccd5ee04"],"fixed":["1.29.1-0.20260804193351-8cf7ccd5ee04"]}]},{"id":"GO-2026-6440","url":"https://osv.dev/vulnerability/GO-2026-6440","summary":"Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher in github.com/amir20/dozzle","modified":"2026-09-10T15:15:15.753638585Z","packages":[{"ecosystem":"Go","name":"github.com/amir20/dozzle","purl":"pkg:golang/github.com/amir20/dozzle","ranges":["<1.29.1-0.20260804193351-8cf7ccd5ee04"],"fixed":["1.29.1-0.20260804193351-8cf7ccd5ee04"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}