pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs (CVE-2026-48737) | HOL Guard CVE

Medium severityCVE-2026-48737GHSA-M5X5-28JR-GPJJ

pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

Answer in brief

CVE-2026-48737 records a Medium severity vulnerability in pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs. The current sources do not mark it as known exploited. The current feed maps pyload/pyload (generic), pyload-ng (pip). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 15, 2026Updated Sep 16, 2026Source checked Sep 17, 2026First seen by HOL Jul 9, 2026Material review Sep 16, 2026

Upstream Advisory

Key facts

Risk: Medium
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Not reported

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps pyload/pyload (generic), pyload-ng (pip). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
pyload/pyloadgeneric	< 0.5.0b3.dev101	Not reported
pyload-ngpip	<=0.5.0b3.dev100	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for pyload/pyload, pyload-ng.
Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Jul 9, 2026

Sources and claim methodology

Upstream source description

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src/pyload/core/utils/web/check.py relies on Python's global-address classification without examining IPv4 destinations embedded in 6to4 or NAT64 IPv6 addresses. A low-privileged user can submit an IPv6 literal through parse_urls to the pre-resolution is_global_host guard. Because host_to_ip is pinned to AF_INET, that guard does not evaluate a hostname's AAAA result. Separately, curl resolves hostnames before the pycurl PREREQFUNC in src/pyload/core/network/http/http_request.py applies the same vulnerable is_global_address check to the actual connection address, so a transition-form AAAA result can be permitted even when it terminates at an embedded loopback, private, CGNAT, or link-local IPv4 address. Exploitation requires the pyLoad host to route the applicable transition mechanism, including 6to4 on affected Python 3.9 through 3.11 deployments or NAT64 on a network with a NAT64 gateway. Successful exploitation can enable internal-network reconnaissance, timing-based confirmation, limited service disruption, or cloud metadata disclosure where the wrapped address is routable. This issue is fixed in version 0.5.0b3.dev101.

Quoted source text, attributed separately from HOL analysis.