CVE-2026-115411: Ssrf Dns Gate Validates Single Addresscve-2026-115411-ssrf-dns-gate-validates-single-address
Incomplete SSRF gate: the hostname is resolved with lookup() without { all: true } and only the single destructured `address` is passed to the private/reserved-IP check. A hostname whose RRset also contains a private or reserved address -- or whose answer changes between this check and the connection (DNS rebinding / check-to-use) -- passes the gate, so the
