Andrey Antukh d39b135feb 🐛 Block IPv6 transition addresses in SSRF guard ...

The outbound HTTP SSRF blocklist did not classify NAT64
(64:ff9b::/96), 6to4 (2002::/16) or Teredo (2001:0000::/32)
addresses, whose embedded IPv4 target is invisible to the JVM
InetAddress predicates, so URLs resolving to them could reach cloud
metadata, loopback or RFC 1918 hosts from webhook delivery and media
import.

Transition ranges are now rejected outright and any embedded IPv4 is
re-checked against the full blocklist, including operator-supplied
extra blocked CIDRs.

Closes #11319

2026-08-21 13:45:04 +02:00

..

backend_tests

🐛 Block IPv6 transition addresses in SSRF guard

2026-08-21 13:45:04 +02:00

e2e

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00