CVE-2026-50127 — Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)

Affected: WeblateOrg weblate

Weblate is a web based localization tool. From version 5.15 to before version 2026.6, Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions. This issue has been patched in version 2026.6.

GHSA-vmfc-9982-2m45 — Weblate SSRF: outbound URL guard misses some private ranges

Affected: PyPI: weblate

### Impact

Weblate's `VCS_RESTRICT_PRIVATE` did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions.

### Patches

* https://github.com/WeblateOrg/weblate/pull/19768

### Resources

The issue was reported by @tonghuaroot via GitHub, and the same user also provided the initial patch.

Most recent entries from all

CVE-2026-50127 — Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)

GHSA-vmfc-9982-2m45 — Weblate SSRF: outbound URL guard misses some private ranges