CVE-2026-75856

HIGH 8.6

CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU

CVSS Score

8.6

EPSS Score

0.0%

EPSS Percentile

0th

CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.

CWE	CWE-918
Vendor	hmbown
Product	codewhale
Published	Aug 18, 2026

Stay Ahead of the Next One

Get instant alerts for hmbown codewhale

Be the first to know when new high vulnerabilities affecting hmbown codewhale are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Hmbown / CodeWhale

0.8.5 < 0.8.41

Hmbown / CodeWhale

0.8.5 < 0.8.41

Hmbown / CodeWhale

0.8.41 < 0.8.64

Hmbown / CodeWhale

0.8.41 < 0.8.64

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmh github.com: https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e vulncheck.com: https://www.vulncheck.com/advisories/codewhale-before-ssrf-bypass-via-dns-pinning-toctou

Credits

🔍 JafarAkhondali