--- title: SVIXSEC-2026-0001: Svix SSRF bypass | daily.dev description: Svix disclosed SVIXSEC-2026-0001, an SSRF bypass in its webhook server caused by IPv6 address literals enclosed in square brackets not being detected by its... canonical: https://daily.dev/posts/svixsec-2026-0001-svix-ssrf-bypass-vno79abki twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SVIXSEC-2026-0001: Svix SSRF bypass | daily.dev og:description: Svix disclosed SVIXSEC-2026-0001, an SSRF bypass in its webhook server caused by IPv6 address literals enclosed in square brackets not being detected by its... og:url: https://daily.dev/posts/svixsec-2026-0001-svix-ssrf-bypass-vno79abki og:image: https://api.daily.dev/og/posts/VNO79abKI.png og:image:alt: SVIXSEC-2026-0001: Svix SSRF bypass og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SVIXSEC-2026-0001: Svix SSRF bypass **[Svix Blog](https://daily.dev/sources/svix)** · 7 min read · 0 upvotes · 0 comments ## Summary Svix disclosed SVIXSEC-2026-0001, an SSRF bypass in its webhook server caused by IPv6 address literals enclosed in square brackets not being detected by its outbound URL filtering. Attackers with permission to create endpoints could craft URLs pointing at arbitrary IPv6 or IPv4-mapped IPv6 addresses, bypassing SSRF protections and reaching internal, unauthenticated services. The root cause traces to a behavior difference between Python's urllib and Rust's url/http::uri crates during Svix's migration from Python to Rust. The bug was fixed by detecting and trimming bracketed host values before applying existing IP filtering. Svix also added OCI annotations and UAPI package metadata to container images and binaries for better security scanner visibility, and is pursuing a CVE via MITRE. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What was the SVIXSEC-2026-0001 SSRF vulnerability in the Svix server? It was a bug where URLs containing an IPv6 address literal enclosed in square brackets bypassed Svix's outbound IP filtering, letting attackers create endpoints pointing at arbitrary internal IPv6 or IPv4-mapped IPv6 addresses (like ::ffff:c0a8:0001 for 192.168.0.1) and reach unauthenticated internal services. It was fixed by stripping the brackets before applying existing IP-filtering logic, in Svix server pull request #2464. _Track SSRF fixes like this one on daily.dev when hardening webhook delivery infrastructure._ ### Why does url::Url::host() in Rust behave differently from Python's urllib.parse for bracketed IP addresses? Rust's url and http::uri crates return the host of a bracketed IP literal, such as "[1.2.3.4]", still wrapped in brackets, whereas Python's urllib.parse.urlparse strips the brackets and returns just "1.2.3.4". This discrepancy caused Svix's IP-filtering logic, ported from Python to Rust, to fail to recognize bracketed IPv6 literals as IP addresses, enabling an SSRF bypass. _Developers porting URL-parsing logic between languages can compare edge cases like this on daily.dev._ ### How can I detect and prevent SSRF attacks using bracketed IPv6 address literals in URLs? Filter outbound requests by inspecting the parsed host value for square brackets, trimming them, and then applying IP-based blocklist checks, since RFC 3986 section 3.2.2 permits any IP literal in brackets but libraries like Rust's url crate only allow IPv6 literals there. Also disregard redirects and use a custom DNS resolver that blocks disallowed IPs and rebinding attacks. _Engineers building SSRF protections can compare mitigation approaches on daily.dev._ ## Similar posts on daily.dev - [CVE-2026-48736: IpUtils::PRIVATE\_SUBNETS Omits IPv6 Transition Forms: SSRF Bypass in NoPrivateNetworkHttpClient \(Symfony Blog\)](https://daily.dev/posts/cve-2026-48736-iputils-private-subnets-omits-ipv6-transition-forms-ssrf-bypass-in-noprivatenetwor-h1uk3rm00) · Symfony · 0 upvotes · 0 comments - [How We Bypassed an Axios Security Patch \(CVE-2026–42043\): The 16-Million IP Loophole](https://daily.dev/posts/how-we-bypassed-an-axios-security-patch-cve-2026-42043-the-16-million-ip-loophole-9cs8ox4oq) · InfoSec Write-ups · 0 upvotes · 0 comments - [CVE-2026-25765 \(faraday\): Faraday affected by SSRF via protocol-relative URL host override in build\_exclusive\_url](https://daily.dev/posts/cve-2026-25765-faraday-faraday-affected-by-ssrf-via-protocol-relative-url-host-override-in-build--axr8zcqbx) · RUBYLAND · 0 upvotes · 0 comments - [GitHub - scoville/req\_ssrf: SSRF protection for Req](https://daily.dev/posts/github---scoville-req-ssrf-ssrf-protection-for-req-4awzo12ju) · ElixirStatus · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#rust](https://daily.dev/tags/rust) [View this post on daily.dev](https://daily.dev/posts/svixsec-2026-0001-svix-ssrf-bypass-vno79abki) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SVIXSEC-2026-0001: Svix SSRF bypass","url":"https://daily.dev/posts/svixsec-2026-0001-svix-ssrf-bypass-vno79abki","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/svixsec-2026-0001-svix-ssrf-bypass-vno79abki"},"datePublished":"2026-08-23T07:20:40.411Z","dateModified":"2026-08-23T07:24:15.002Z","description":"Svix disclosed SVIXSEC-2026-0001, an SSRF bypass in its webhook server caused by IPv6 address literals enclosed in square brackets not being detected by its...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c29c15d2073fe6ec67988f7bfa53b8c2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c29c15d2073fe6ec67988f7bfa53b8c2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Svix Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Svix Blog","logo":"https://media.daily.dev/image/upload/s--Shf9MlOr--/f_auto,q_auto/v1787469609/logos/svix?_a=BAMAMicg0","url":"https://daily.dev/sources/svix"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/svixsec-2026-0001-svix-ssrf-bypass-vno79abki","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,rust","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Svix Blog","item":"https://daily.dev/sources/svix"},{"@type":"ListItem","position":3,"name":"SVIXSEC-2026-0001: Svix SSRF bypass"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/svixsec-2026-0001-svix-ssrf-bypass-vno79abki#faq","mainEntity":[{"@type":"Question","name":"What was the SVIXSEC-2026-0001 SSRF vulnerability in the Svix server?","acceptedAnswer":{"@type":"Answer","text":"It was a bug where URLs containing an IPv6 address literal enclosed in square brackets bypassed Svix's outbound IP filtering, letting attackers create endpoints pointing at arbitrary internal IPv6 or IPv4-mapped IPv6 addresses (like ::ffff:c0a8:0001 for 192.168.0.1) and reach unauthenticated internal services. It was fixed by stripping the brackets before applying existing IP-filtering logic, in Svix server pull request #2464. Track SSRF fixes like this one on daily.dev when hardening webhook delivery infrastructure."}},{"@type":"Question","name":"Why does url::Url::host() in Rust behave differently from Python's urllib.parse for bracketed IP addresses?","acceptedAnswer":{"@type":"Answer","text":"Rust's url and http::uri crates return the host of a bracketed IP literal, such as \"[1.2.3.4]\", still wrapped in brackets, whereas Python's urllib.parse.urlparse strips the brackets and returns just \"1.2.3.4\". This discrepancy caused Svix's IP-filtering logic, ported from Python to Rust, to fail to recognize bracketed IPv6 literals as IP addresses, enabling an SSRF bypass. Developers porting URL-parsing logic between languages can compare edge cases like this on daily.dev."}},{"@type":"Question","name":"How can I detect and prevent SSRF attacks using bracketed IPv6 address literals in URLs?","acceptedAnswer":{"@type":"Answer","text":"Filter outbound requests by inspecting the parsed host value for square brackets, trimming them, and then applying IP-based blocklist checks, since RFC 3986 section 3.2.2 permits any IP literal in brackets but libraries like Rust's url crate only allow IPv6 literals there. Also disregard redirects and use a custom DNS resolver that blocks disallowed IPs and rebinding attacks. Engineers building SSRF protections can compare mitigation approaches on daily.dev."}}]} ```