CVE-2026-112991
MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()
02 Description
MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- Not scored by EPSS
- EPSS percentile
- Not scored by EPSS
- NVD base score
- 6.3 (CVSS v4.0), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVD analysis status
- Received. NVD last modified this record on 2026-10-19.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-10-19 22:19Z1 HR AGO
- Last updated
- 2026-10-19 22:19Z1 HR AGO
- Reserved
- 2026-10-19
- Assigning CNA
- CIRCL
- Record state
- PUBLISHED
- Severity
- Medium (CVSS 6.3)
- CNA CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
- Weaknesses
- Data version
- 5.2
- Document digest
- ea5e8d4cc1daa92b755c26c901cfa2577fa6ef46c2eb2c5c32e6ab0344784a82
05 Affected products
06 References
- github.comSecurity patchhttps://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b
07 Remediation
The fix extends the BLOCKED_RANGES list in is_safe_url() to include the previously missing IP address ranges: 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. The existing IPv4-mapped IPv6 normalisation logic ensures that mapped forms (e.g., ::ffff:0.0.0.0) are also blocked. Regression tests are added covering both literal IP addresses in URLs and hostnames that resolve to the newly blocked ranges.