Vulnerability Description
CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d
- https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmh
- https://www.vulncheck.com/advisories/codewhale-before-ssrf-bypass-via-dns-pinnin
- https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmh
FAQ
What is CVE-2026-75856?
CVE-2026-75856 is a vulnerability with a CVSS score of 8.6 (HIGH). CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses...
How severe is CVE-2026-75856?
CVE-2026-75856 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-75856?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.