GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
6965
Downloads
12.9M
Verified
6965
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
1 rules matched. Showing 1 loaded rules.
Publish rule
CVE-2026-115729: Ssrf Hostname String Denylist Fail Opencve-2026-115729-ssrf-hostname-string-denylist-fail-open

The fetch-URL guard for $HOST is a string denylist over `URL.hostname` that ends in an unconditional `return true`, so it fails open for any host encoding that is not listed verbatim. Canonicalization defeats exact-match checks: `http://[::ffff:127.0.0.1]/` becomes hostname `[::ffff:7f00:1]` (hex groups), and `[::]`, `[febf::1]`, NAT64 `[64:ff9b::...]`, 6to4

JSCVE-2026-115729CWE-918
by Provallyupdated 2026-10-27Apache-2.0
450 direct45 via packs
83
All matching rules loaded.