ETK-2026-2503Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2503",
  "cve_id": null,
  "display_id": "ETK-2026-2503",
  "ghsa_id": "GHSA-c9wc-jcr5-8974",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "IPv6 transition-address SSRF filter bypass in SurrealDB",
  "summary": "SurrealDB versions before 3.3.0 can misclassify certain IPv6 transition addresses while applying outbound network restrictions. An authenticated user able to trigger outbound HTTP requests may reach internal IPv4 services when the host supports the relevant transition-address routing.",
  "mitigation": "Upgrade the surrealdb package to version 3.3.0. Until upgraded, restrict untrusted users' ability to initiate outbound HTTP requests and apply egress controls for internal destinations.",
  "vendor": "rust",
  "product": "surrealdb",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.2.0, < 3.3.0"
      ],
      "ecosystem": "rust",
      "fixed_versions": [
        "3.3.0"
      ],
      "package_name": "surrealdb",
      "purl": "pkg:cargo/surrealdb"
    }
  ],
  "cwes": null,
  "cvss_score": 7,
  "cvss_src": "ethiack_provisional",
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 25.154826016666668,
  "t0_at": null,
  "signals": {
    "check": {
      "at": "2026-10-22T21:31:15.057974+00:00",
      "days": -0.014024378888888888,
      "is_lower_bound": true,
      "measured_at": "2026-10-22T21:51:26.803256+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-19T08:51:38+00:00",
      "days": -3.5415366239583332,
      "is_lower_bound": true,
      "measured_at": "2026-10-22T21:51:26.803256+00:00",
      "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-c9wc-jcr5-8974"
    }
  }
}