{"id":"DEBIAN-CVE-2026-50134","details":"Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server (or an attacker controlling its DNS or response) could therefore redirect the request to a host that the policy was meant to forbid and Hugo would fetch from the redirected target. The same bypass also lifted any host-shape restriction the operator had put in place. This vulnerability is fixed in 0.162.0.","modified":"2026-08-27T23:06:07.363255136Z","published":"2026-07-06T20:16:37.197Z","upstream":["CVE-2026-50134"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-50134"}],"affected":[{"package":{"name":"hugo","ecosystem":"Debian:12","purl":"pkg:deb/debian/hugo?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.111.3-1","0.112.7-1","0.113.0-1","0.113.0-2","0.113.0-3","0.114.1-1","0.114.1-2","0.115.4-1","0.116.1-1","0.117.0-1","0.118.2-1","0.119.0-1","0.119.0-2","0.120.3-1","0.120.4-1","0.121.1-1","0.121.2-1","0.122.0-1","0.123.3-1","0.123.7-1","0.123.8-1","0.123.8-2","0.124.1-1","0.125.4-1","0.125.5-1","0.125.6-1","0.125.7-1","0.126.1-1","0.126.2-1","0.126.3-1","0.127.0-1","0.128.2-1","0.128.2-2","0.129.0-1","0.129.0-2","0.130.0-1","0.130.0-2","0.131.0-1","0.131.0-2","0.150.0-1","0.150.1-1","0.151.0-1","0.151.1-1","0.151.2-1","0.152.1-1","0.152.2-1","0.153.0-1","0.153.1-1","0.153.1-2","0.153.1-3","0.153.2-1","0.154.1-1","0.154.2-1","0.154.2-2","0.154.3-1","0.154.5-1","0.155.1-1","0.155.2-1","0.155.3-1","0.157.0-1","0.157.0-2","0.157.0-3","0.158.0-1","0.158.0-2","0.158.0-3","0.159.0-1","0.159.1-1","0.159.2-1","0.160.0-1","0.160.0-2","0.160.1-1","0.161.0-1","0.161.1-1","0.162.1-1","0.162.1-2","0.162.1-3","0.162.1-4","0.162.1-5","0.162.1-6","0.162.1-7","0.165.0-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-50134.json"}},{"package":{"name":"hugo","ecosystem":"Debian:13","purl":"pkg:deb/debian/hugo?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.131.0-1","0.131.0-2","0.150.0-1","0.150.1-1","0.151.0-1","0.151.1-1","0.151.2-1","0.152.1-1","0.152.2-1","0.153.0-1","0.153.1-1","0.153.1-2","0.153.1-3","0.153.2-1","0.154.1-1","0.154.2-1","0.154.2-2","0.154.3-1","0.154.5-1","0.155.1-1","0.155.2-1","0.155.3-1","0.157.0-1","0.157.0-2","0.157.0-3","0.158.0-1","0.158.0-2","0.158.0-3","0.159.0-1","0.159.1-1","0.159.2-1","0.160.0-1","0.160.0-2","0.160.1-1","0.161.0-1","0.161.1-1","0.162.1-1","0.162.1-2","0.162.1-3","0.162.1-4","0.162.1-5","0.162.1-6","0.162.1-7","0.165.0-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-50134.json"}},{"package":{"name":"hugo","ecosystem":"Debian:14","purl":"pkg:deb/debian/hugo?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.162.1-1"}]}],"versions":["0.131.0-1","0.131.0-2","0.150.0-1","0.150.1-1","0.151.0-1","0.151.1-1","0.151.2-1","0.152.1-1","0.152.2-1","0.153.0-1","0.153.1-1","0.153.1-2","0.153.1-3","0.153.2-1","0.154.1-1","0.154.2-1","0.154.2-2","0.154.3-1","0.154.5-1","0.155.1-1","0.155.2-1","0.155.3-1","0.157.0-1","0.157.0-2","0.157.0-3","0.158.0-1","0.158.0-2","0.158.0-3","0.159.0-1","0.159.1-1","0.159.2-1","0.160.0-1","0.160.0-2","0.160.1-1","0.161.0-1","0.161.1-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-50134.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"}]}