{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-VULN-PYPI-2026-000635","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-10-27T21:56:29Z","dateUpdated":"2026-10-27T22:45:37Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"If you run aimarket-hestia 0.1.0 through 0.1.2, an owner binding a domain (POST /v1/owners/me/domain) can make your server open connections to port 443 of addresses inside your network and learn from the error it returns whether they accept connections. domains.https_proofs calls domains.require_public, which refuses a domain resolving to anything but global addresses, then requests https://\u003cdomain\u003e/.well-known/hestia-owner.json by name, so a domain that rebinds to a private address after the check is contacted. require_public also treats the NAT64 prefix 64:ff9b::/96 as public, so on a host that routes it a domain resolving to the NAT64 form of a private IPv4 address passes. The client honours HTTPS_PROXY, ALL_PROXY and SSL_CERT_FILE, so behind a TLS-inspecting egress proxy the GET reaches the internal service. The path is fixed and only owner_pubkeys is read from the answer, but the 403 names the exception, which tells a refused connection, a timeout and a TLS failure apart. Fixed in 0.1.3: the fetch goes to the checked address with the domain in Host and TLS SNI, proxy and CA environment variables are ignored, and IPv4-mapped, 6to4 and NAT64 addresses are judged by the IPv4 address they carry. Affects 0.1.0 through 0.1.2.","supportingMedia":null}],"references":[{"url":"https://pypi.org/project/aimarket-hestia/","name":"","tags":["advisory"]},{"url":"https://github.com/alexar76/hestia/commit/c9870f7fe6e5e297ca9f7510cc7cd08dca91addb","name":"Fix: hestia 0.1.3","tags":["fix"]},{"url":"https://pypi.org/project/aimarket-hestia/0.1.3/","name":"aimarket-hestia 0.1.3","tags":["release"]}],"metrics":[{"format":"","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","baseScore":3.5,"baseSeverity":"LOW"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Time-of-check Time-of-use (TOCTOU) Race Condition","cweId":"CWE-367","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Server-Side Request Forgery (SSRF)","cweId":"CWE-918","type":"CWE"}]}],"affected":[{"vendor":"pypi","product":"aimarket-hestia","collectionURL":"https://pypi.org","packageName":"aimarket-hestia","repo":"","defaultStatus":"unaffected","versions":[{"version":"0.1.0","status":"affected","versionType":"python","lessThan":"0.1.3","lessThanOrEqual":"","changes":null},{"version":"0.1.3","status":"unaffected","versionType":"python","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":["hestia.domains"],"programFiles":["hestia/domains.py"],"programRoutines":[{"name":"hestia.domains.https_proofs"},{"name":"hestia.domains.require_public"},{"name":"hestia.domains.prove"}],"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}