CVE-2026-92395: Proxy Addr Ipv4 Mapped Subnet Bypasscve-2026-92395-proxy-addr-ipv4-mapped-subnet-bypass
Cross-family IP address conversion using `toIPv4MappedAddress()` without verifying that the target IPv6 subnet prefix length is at least 96 bits allows IPv4-mapped subnets with short prefix lengths (such as /8) to match all IPv4 addresses. This allows unauthenticated clients to bypass IP-based access control and spoof client IP addresses.
