https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 18:14:52 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44502 <p><strong>Affected:</strong> bugsink</p> <p>Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing. The original validation logic parsed webhook URLs with Python’s urllib.parse.urlparse, then sent the request with requests.post. For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is the real target. A URL may therefore appear to target an allowlisted public hostname during validation, while the HTTP client actually connects to a different host. This vulnerability is fixed in 2.1.3.</p> <p><strong>Affected:</strong> bugsink</p> <p>Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing. The original validation logic parsed webhook URLs with Python’s urllib.parse.urlparse, then sent the request with requests.post. For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is the real target. A URL may therefore appear to target an allowlisted public hostname during validation, while the HTTP client actually connects to a different host. This vulnerability is fixed in 2.1.3.</p> https://cve.radiocsirt.org/vuln/cve-2026-44502 https://cve.radiocsirt.org/vuln/ghsa-fp53-qcf8-2xx2 <p><strong>Affected:</strong> PyPI: bugsink</p> <p>## Summary</p> <p>Bugsink’s webhook URL validation in versions 2.1.2 and earlier could be (partially) bypassed because of a mismatch in URL parsing.</p> <p>In some malformed URLs, Python’s standard URL parser (urllib) and the HTTP client stack (requests / urllib3) do not agree on which host is actually being targeted. That could allow a webhook URL to pass Bugsink’s outbound-host checks while the actual HTTP request is sent somewhere else.</p> <p>## Impact</p> <p>This issue affects Bugsink’s outbound webhook integrations.</p> <p>An attacker who can supply or influence a webhook URL may be able to make Bugsink send an outbound HTTP POST request to a host that should have been blocked by the webhook validation logic, including loopback, private, or otherwise non-allowlisted destinations.</p> <p>The practical impact is limited:</p> <p>- this is an outbound webhook SSRF issue, not a general-purpose proxy - Bugsink does not follow redirects for these webhook requests - the request shape is constrained by how the malformed URL is normalized by the HTTP client - this does not give arbitrary control over every possible request path</p> <p>In other words, this is a real validation bypass, but it is narrower than a full arbitrary-request primitive.</p> <p>## Technical Details</p> <p>The original validation logic parsed webhook URLs with Python’s urllib.parse.urlparse, then sent the request with requests.post.</p> <p>For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is t…</p> <p><strong>Affected:</strong> PyPI: bugsink</p> <p>## Summary</p> <p>Bugsink’s webhook URL validation in versions 2.1.2 and earlier could be (partially) bypassed because of a mismatch in URL parsing.</p> <p>In some malformed URLs, Python’s standard URL parser (urllib) and the HTTP client stack (requests / urllib3) do not agree on which host is actually being targeted. That could allow a webhook URL to pass Bugsink’s outbound-host checks while the actual HTTP request is sent somewhere else.</p> <p>## Impact</p> <p>This issue affects Bugsink’s outbound webhook integrations.</p> <p>An attacker who can supply or influence a webhook URL may be able to make Bugsink send an outbound HTTP POST request to a host that should have been blocked by the webhook validation logic, including loopback, private, or otherwise non-allowlisted destinations.</p> <p>The practical impact is limited:</p> <p>- this is an outbound webhook SSRF issue, not a general-purpose proxy - Bugsink does not follow redirects for these webhook requests - the request shape is constrained by how the malformed URL is normalized by the HTTP client - this does not give arbitrary control over every possible request path</p> <p>In other words, this is a real validation bypass, but it is narrower than a full arbitrary-request primitive.</p> <p>## Technical Details</p> <p>The original validation logic parsed webhook URLs with Python’s urllib.parse.urlparse, then sent the request with requests.post.</p> <p>For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is t…</p> https://cve.radiocsirt.org/vuln/ghsa-fp53-qcf8-2xx2