Skip to content

Network, parser, render, and resource-boundary batch

Source: GitHub Security Advisories, published/updated 2026-05-05.

This batch is durable because small parser and rendering mistakes turn into SSRF, denial of service, data exfiltration, and stored script execution. URL validators, DNS parsers, protocol sniffers, spreadsheet exports, and forum/admin pages need bounded, canonical interpretation.

Advisories covered

Operator triage

  1. Inventory unauthenticated fetch/CORS/proxy endpoints and libraries advertised as SSRF filters; retest with IPv6, IPv4-mapped IPv6, octal/decimal IPs, redirects, DNS rebinding, link-local, loopback, multicast, and documentation ranges.
  2. Disable protocol sniffing and recursive parser features where not required; otherwise place them behind packet, recursion-depth, object-count, and memory limits.
  3. For BGP, DNS, QUIC, ASN.1, and OID parsers, fuzz malformed length, pointer, recursion, and compression cases before accepting internet-facing input.
  4. Search for exported spreadsheets containing user-controlled values that begin with =, +, -, @, tab, CR, or LF.
  5. Hunt forum/admin logs for suspicious User-Agent payloads, stored script tags, blind SQL execution attempts, and admin pages reached before authorization middleware.

Durable controls

  • SSRF defenses must use a positive egress policy, not only a deny list. Resolve and classify the final destination for every request and redirect.
  • Parser loops need explicit depth, allocation, decompression, pointer-hop, and time budgets with fail-closed behavior.
  • Spreadsheet exports should prefix dangerous cell values or emit them as typed strings, never raw formulas.
  • Authorization middleware must run before route handlers, logging sinks, or admin pre-handlers that can mutate or query data.
  • Stored-render surfaces need context-specific output encoding, including admin/event logs that display request headers.