Repository navigation

fix(everything): block SSRF to internal/metadata IPs in gzip-file-as-resource - #4498

Closed

olaservo wants to merge 8 commits into

modelcontextprotocol:v2/mainfrom

olaservo:fix/everything-gzip-ssrf

Closed

fix(everything): block SSRF to internal/metadata IPs in gzip-file-as-resource#4498
olaservo wants to merge 8 commits into
modelcontextprotocol:v2/mainfrom
olaservo:fix/everything-gzip-ssrf

Commits on Jul 8, 2026
- fix(everything): block SSRF to internal/metadata IPs in gzip-file-as-resource
  
  olaservo
  and
  claude
  committed
  889a308
Commits on Jul 10, 2026
- fix(everything): block IPv4-compatible IPv6 (::/96) SSRF targets
  
  olaservo
  and
  claude
  committed
  75cf529
Commits on Jul 14, 2026
- fix(everything): bound DNS resolution to fetch timeout; test redirect guard
  
  olaservo
  and
  claude
  committed
  d2d2ef8
- refactor(everything): throw at redirect limit before following next hop
  
  olaservo
  and
  claude
  committed
  a115311
Commits on Jul 20, 2026
- fix(everything): drain redirect bodies; test hostname SSRF path
  
  olaservo
  and
  claude
  committed
  b688426
- fix(everything): wrap DNS lookup failures with host and URL context
  
  olaservo
  and
  claude
  committed
  b8df517
Commits on Aug 10, 2026
- fix(everything): block IPv6 forms that embed an internal IPv4 address
  
  olaservo
  and
  claude
  committed
  a223f12
Commits on Aug 13, 2026
- fix(everything): treat global unicast as an allow list for IPv6
  
  olaservo
  and
  claude
  committed
  217da58