CVE-2026-58404 Details
Description
Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses, including integer, hex, or octal, passed the policy. When a template passes an untrusted or data-derived URL to resources.GetRemote and the host platform uses the cgo system resolver, these encodings resolve to the blocked address, allowing build-time server-side requests to loopback and internal services, including the cloud-metadata endpoint in hosted or CI builds; the same check is reused on redirects, so the gap also applies to each redirect hop. This issue is fixed in v0.163.1.
A vulnerability in Hugo, a static site generator, allows bypassing the default security policy that denies requests to loopback, internal, and cloud-metadata IPv4 addresses. This issue is present in versions 0.162.0 through 0.163.0. The denial rule only applied to dotted-decimal notation, leaving alternative encodings such as integer, hex, or octal unblocked. When a template sends an untrusted URL to 'resources.GetRemote' and the cgo system resolver is used, these encodings can resolve to the restricted addresses, enabling server-side requests to internal services and the cloud-metadata endpoint during hosted or CI builds. This vulnerability also affects redirect hops.
Users can update to Hugo version 0.163.1 or later, where this vulnerability is patched. In version 0.163.1, integer, hex, and octal IPv4 hosts are normalized to dotted-decimal before the security policy is applied, ensuring all encodings are treated the same.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gohugo hugo | >= 0.162.0, < 0.163.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | New CVE Received | [email protected] |