-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the VerifySourceNetwork function's IP validation logic. The original implementation in security/source.go only checked for loopback addresses using Go's ip.IsLoopback() which excludes 0.0.0.0. The commit diff shows the vulnerability was patched by adding ip.IsUnspecified() check to block 0.0.0.0 addresses. This function is directly responsible for source address validation and contained the flawed logic described in the advisory.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/imgproxy/imgproxy | go | < 3.27.2 | 3.27.2 |