Most recent entries from all

EUVD-2026-333703

fkie_cve-2026-58404

Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses, including integer, hex, or octal, passed the policy. When a template passes an untrusted or data-derived URL to resources.GetRemote and the host platform uses the cgo system resolver, these encodings resolve to the blocked address, allowing build-time server-side requests to loopback and internal services, including the cloud-metadata endpoint in hosted or CI builds; the same check is reused on redirects, so the gap also applies to each redirect hop. This issue is fixed in v0.163.1.

GHSA-r46f-3rpw-hxrv — Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF)

Affected: Go: github.com/gohugoio/hugo

### Impact

The default `security.http.urls` policy denies requests to loopback, internal, and cloud-metadata IPv4 literals (e.g. `http://127.0.0.1/`, `http://169.254.169.254/`). The deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses — integer, hex, or octal, which contain no dot — passed the policy:

- `http://2130706433/` → `127.0.0.1` - `http://2852039166/` → `169.254.169.254` (cloud metadata) - `http://0x7f000001/`, `http://017700000001/`, `http://0/`

When a template passes an untrusted or data-derived URL to `resources.GetRemote` and the host platform uses the cgo system resolver, these encodings resolve to the blocked address — allowing build-time server-side requests to loopback and internal services, including the cloud-metadata endpoint in hosted/CI builds. The same check is reused on redirects, so the gap also applies to each redirect hop.

This affects sites that rely on `security.http.urls` as a security boundary while fetching attacker-influenced remote URLs; it does not affect sites that fully trust the URLs they fetch.

### Patches

Fixed in **v0.163.1**. Integer/hex/octal IPv4 hosts are now canonicalized to dotted-decimal before the policy is applied, so every encoding of an address is treated alike. No configuration change is required.

### Workarounds

Avoid passing untrusted URLs to `resources.GetRemote`, or tighten `security.http.urls` to an explicit allow-list…

RHSA-2026:36862 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

github.com/gohugoio/hugo: Hugo: Cross-site Scripting via untrusted HTML content files github.com/gohugoio/hugo: Hugo: Cross-site Scripting via unescaped code-fence language in default code block renderer github.com/gohugoio/hugo: Hugo: Information disclosure via symlink confinement bypass in virtual filesystem github.com/gohugoio/hugo: Hugo: Server-Side Request Forgery (SSRF) via alternate IPv4 encodings

UBUNTU-CVE-2026-58404

Affected: Ubuntu:16.04:LTS: hugo, Ubuntu:18.04:LTS: hugo, Ubuntu:20.04:LTS: hugo, Ubuntu:22.04:LTS: hugo, Ubuntu:Pro:24.04:LTS: hugo, Ubuntu:25.10: hugo, Ubuntu:26.04:LTS: hugo