Vulnerability Description
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java blocks the RFC 6052 64:ff9b::/96 NAT64 prefix but omits the RFC 8215 64:ff9b:1::/48 local-use prefix. On a dual-stack server using RFC 8215 NAT64, an unauthenticated user who can execute Lua code can use http.request or http.websocket with an address under 64:ff9b:1::/48 to reach loopback, RFC 1918, cloud metadata, or internal API endpoints because PrivatePattern.matches() does not classify the mapped IPv6 address as private. This issue is fixed in version 1.120.0.
Related Weaknesses (CWE)
References
- https://github.com/cc-tweaked/CC-Tweaked/commit/d1bfb2571d3bde55529fac50d8303b74
- https://github.com/cc-tweaked/CC-Tweaked/security/advisories/GHSA-2rrx-mch2-76cp
- https://github.com/cc-tweaked/CC-Tweaked/security/advisories/GHSA-2rrx-mch2-76cp
FAQ
What is CVE-2026-55758?
CVE-2026-55758 is a documented vulnerability. CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/dan200/computercraft/core/apis...
How severe is CVE-2026-55758?
CVSS scoring is not yet available for CVE-2026-55758. Check NVD for updates.
Is there a patch for CVE-2026-55758?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.