{"id":"DEBIAN-CVE-2026-58404","details":"Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses, including integer, hex, or octal, passed the policy. When a template passes an untrusted or data-derived URL to resources.GetRemote and the host platform uses the cgo system resolver, these encodings resolve to the blocked address, allowing build-time server-side requests to loopback and internal services, including the cloud-metadata endpoint in hosted or CI builds; the same check is reused on redirects, so the gap also applies to each redirect hop. This issue is fixed in v0.163.1.","modified":"2026-09-07T05:00:09.330508424Z","published":"2026-07-06T20:16:38.307Z","upstream":["CVE-2026-58404"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-58404"}],"affected":[{"package":{"name":"hugo","ecosystem":"Debian:14","purl":"pkg:deb/debian/hugo?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.165.0-1"}]}],"versions":["0.131.0-1","0.131.0-2","0.150.0-1","0.150.1-1","0.151.0-1","0.151.1-1","0.151.2-1","0.152.1-1","0.152.2-1","0.153.0-1","0.153.1-1","0.153.1-2","0.153.1-3","0.153.2-1","0.154.1-1","0.154.2-1","0.154.2-2","0.154.3-1","0.154.5-1","0.155.1-1","0.155.2-1","0.155.3-1","0.157.0-1","0.157.0-2","0.157.0-3","0.158.0-1","0.158.0-2","0.158.0-3","0.159.0-1","0.159.1-1","0.159.2-1","0.160.0-1","0.160.0-2","0.160.1-1","0.161.0-1","0.161.1-1","0.162.1-1","0.162.1-2","0.162.1-3","0.162.1-4","0.162.1-5","0.162.1-6","0.162.1-7"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-58404.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N"}]}