fix(everything): block SSRF to internal/metadata IPs in gzip-file-as-resource - #4498

Open

olaservo wants to merge 8 commits into

modelcontextprotocol:mainfrom

olaservo:fix/everything-gzip-ssrf

Commits on Jul 8, 2026

fix(everything): block SSRF to internal/metadata IPs in gzip-file-as-resource

olaservo
and
claude
committed
889a308

Commits on Jul 10, 2026

fix(everything): block IPv4-compatible IPv6 (::/96) SSRF targets

olaservo
and
claude
committed
75cf529

Commits on Jul 14, 2026

fix(everything): bound DNS resolution to fetch timeout; test redirect guard

olaservo
and
claude
committed
d2d2ef8
refactor(everything): throw at redirect limit before following next hop

olaservo
and
claude
committed
a115311

Commits on Jul 20, 2026

fix(everything): drain redirect bodies; test hostname SSRF path

olaservo
and
claude
committed
b688426
fix(everything): wrap DNS lookup failures with host and URL context

olaservo
and
claude
committed
b8df517

Commits on Aug 10, 2026

fix(everything): block IPv6 forms that embed an internal IPv4 address

olaservo
and
claude
committed
a223f12

Commits on Aug 13, 2026

fix(everything): treat global unicast as an allow list for IPv6

olaservo
and
claude
committed
217da58