https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 10:08:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292458 EUVD-2026-292458 https://cve.radiocsirt.org/vuln/euvd-2026-292458 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41055 <p>WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo&#39;s LiveLinks proxy adds `isSSRFSafeURL()` validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints. Commit 8d8fc0cadb425835b4861036d589abcea4d78ee8 contains an updated fix.</p> <p>WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo&#39;s LiveLinks proxy adds `isSSRFSafeURL()` validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints. Commit 8d8fc0cadb425835b4861036d589abcea4d78ee8 contains an updated fix.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41055 https://cve.radiocsirt.org/vuln/ghsa-793q-xgj6-7frp <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>### Summary</p> <p>The incomplete SSRF fix in AVideo&#39;s LiveLinks proxy adds `isSSRFSafeURL()` validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints.</p> <p>### Affected Package</p> <p>- **Ecosystem:** Other - **Package:** AVideo - **Affected versions:** &lt; commit 0e56382921fc71e64829cd1ec35f04e338c70917 - **Patched versions:** &gt;= commit 0e56382921fc71e64829cd1ec35f04e338c70917</p> <p>### Details</p> <p>The `plugin/LiveLinks/proxy.php` endpoint proxies live stream URLs. The fix adds `isSSRFSafeURL()` check on the initial URL, redirect URL validation, and `follow_location=0` in the `get_headers()` context. However, multiple DNS TOCTOU vulnerabilities remain.</p> <p>For the initial URL, `isSSRFSafeURL()` resolves DNS once for validation, but `get_headers()` resolves DNS again independently. A DNS rebinding attack with TTL=0 returns a safe external IP for the first resolution and an internal IP for the second.</p> <p>The same TOCTOU exists for redirect URLs: `isSSRFSafeURL()` validates the redirect target (first resolution returns a safe IP), then `fakeBrowser()` makes the actual request (second resolution returns an internal IP).</p> <p>Additionally, even with `follow_location=0`, `get_headers()` still sends an HTTP request that can probe internal services via DNS rebinding, and multiple `Location` headers in a response cause `filter_var()` to receive an array instead of a string, resulting in a fall-through to the else branc…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>### Summary</p> <p>The incomplete SSRF fix in AVideo&#39;s LiveLinks proxy adds `isSSRFSafeURL()` validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints.</p> <p>### Affected Package</p> <p>- **Ecosystem:** Other - **Package:** AVideo - **Affected versions:** &lt; commit 0e56382921fc71e64829cd1ec35f04e338c70917 - **Patched versions:** &gt;= commit 0e56382921fc71e64829cd1ec35f04e338c70917</p> <p>### Details</p> <p>The `plugin/LiveLinks/proxy.php` endpoint proxies live stream URLs. The fix adds `isSSRFSafeURL()` check on the initial URL, redirect URL validation, and `follow_location=0` in the `get_headers()` context. However, multiple DNS TOCTOU vulnerabilities remain.</p> <p>For the initial URL, `isSSRFSafeURL()` resolves DNS once for validation, but `get_headers()` resolves DNS again independently. A DNS rebinding attack with TTL=0 returns a safe external IP for the first resolution and an internal IP for the second.</p> <p>The same TOCTOU exists for redirect URLs: `isSSRFSafeURL()` validates the redirect target (first resolution returns a safe IP), then `fakeBrowser()` makes the actual request (second resolution returns an internal IP).</p> <p>Additionally, even with `follow_location=0`, `get_headers()` still sends an HTTP request that can probe internal services via DNS rebinding, and multiple `Location` headers in a response cause `filter_var()` to receive an array instead of a string, resulting in a fall-through to the else branc…</p> https://cve.radiocsirt.org/vuln/ghsa-793q-xgj6-7frp