CVE-2026-75856

CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU

State: Published
Severity: 9.2 Critical
Published: Aug 18, 2026
Updated: Aug 18, 2026
Reserved: Aug 18, 2026

Description

CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N	VulnCheck
3.1	8.6 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	VulnCheck

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
CodeWhaleHmbown	0.8.5 to before 0.8.41Affected 0.8.41Not affected
CodeWhaleHmbown	0.8.5 to before 0.8.41Affected 0.8.41Not affected
CodeWhaleHmbown	0.8.41 to before 0.8.64Affected 0.8.64Not affected
CodeWhaleHmbown	0.8.41 to before 0.8.64Affected 0.8.64Not affected

References

GitHub Security Advisory (GHSA-6v2g-fpxh-pmmh)vendor-advisory
Patch Commitpatch
VulnCheck Advisory: CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOUthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.