—
GO-2026-6440
Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher in github.com/amir20/dozzle
Quick fix
GO-2026-6440 — github.com/amir20/dozzle: upgrade to the fixed version with the command below.
go get github.com/amir20/dozzle@v1.29.1-0.20260804193351-8cf7ccd5ee04Details
Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher in github.com/amir20/dozzle
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/amir20/dozzle
Introduced in:
0Fixed in: 1.29.1-0.20260804193351-8cf7ccd5ee04Fix
go get github.com/amir20/dozzle@v1.29.1-0.20260804193351-8cf7ccd5ee04References
- https://github.com/amir20/dozzle/security/advisories/GHSA-p2w3-6x73-2f6x[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2026-73087[ADVISORY]
- https://github.com/amir20/dozzle/commit/8cf7ccd5ee041ecaea92b49951793d4d2393761f[FIX]
- https://github.com/amir20/dozzle/pull/4887[FIX]
- https://github.com/amir20/dozzle/releases/tag/v10.6.15[WEB]