CVE-2026-108939 Details
Description
A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function is_global_ip of the file mistralrs-server-core/src/media_source.rs. Such manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.9.4 is recommended to address this issue. The name of the patch is cfb8c6a0c42361dc4579a9110b54d339c255b9fd. The affected component should be upgraded.
A server-side request forgery (SSRF) vulnerability has been identified in EricLBuehler Mistral.rs versions through 0.9.3. The issue arises in the 'is_global_ip' function within 'mistralrs-server-core/src/media_source.rs'. The vulnerability can be exploited remotely by manipulating the 'ip' argument, leading to unauthorized server-side requests.
Upgrade to version 0.9.4, which addresses the vulnerability by modifying the 'is_global_ip' function to correctly handle IPv6 transition addresses.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/EricLBuehler/mistral.rs/ | [email protected] | Vendor |
| https://github.com/EricLBuehler/mistral.rs/commit/cfb8c6a0c | [email protected] | Source CodeVendor |
| https://github.com/EricLBuehler/mistral.rs/commit/cfb8c6a0c42361dc4579a9110b54d339c255b9fd | [email protected] | Source CodeVendor |
| https://github.com/EricLBuehler/mistral.rs/pull/2446 | [email protected] | Issue TrackingVendor |
| https://github.com/EricLBuehler/mistral.rs/releases/tag/v0.9.4 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-108939 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/997600 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416763 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416763/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| EricLBuehler mistral.rs | <= 0.9.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |