CVE-2026-39087

Summary

ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.

Affected Software

Weaknesses

• CWE-777: CWE-777 Regular Expression without Anchors

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

References

• https://gist.github.com/MightyNawaf/5d41d6e8ead16e217f86b016002ecae5
• https://github.com/binwiederhier/ntfy/releases/tag/v2.22.0
• https://ntfy.sh

• ←Previous
• Next→