CVE-2026-73297

CVE-2026-73297 is a reminder that IPv6 is not a single address family but a transport layer carrying multiple address encoding schemes — and your SSRF filter likely treats it as the former. The vulnerability exploits NAT64 (64:ff9b::/96), 6to4 (2002::/16), and Teredo (2001::/32) prefixes, which embed IPv4 addresses inside IPv6 syntax. An address like 64:ff9b::169.254.169.254 is not an IPv6 destination — it's an IPv4 address encoded for translation. If your filter checks 'is this IPv6?' and passes it without further inspection, you've created a blind spot. The practical risk is acute in cloud environments. AWS, GCP, and Azure metadata endpoints at 169.254.169.254 are routinely blocked by SSRF filters that understand RFC-1918 addresses. Those same filters rarely recognize that 64:ff9b::169.254.169.254 reaches the identical endpoint through a different protocol door. The attacker's cost is near-zero — encoding a private IP in IPv6 notation — while the defender's cost to close this gap is architectural: recursive IPv4 extraction from any IPv6 address that encodes non-native IPv6 addresses. What to do now: first, verify whether your filtering layer recursively inspects embedded IPv4 addresses within IPv6 packets. If your validation logic treats IPv6 as a pass-through category, you have this gap. Second, implement prefix blocking for 64:ff9b::/96, 2002::/16, and 2001::/32 as an immediate tactical measure — but understand this is a speedbump, not a structural fix. The next transition mechanism (ISATAP, 6rd, or a tunnel broker) will bypass a blocklist again. Third, update your monitoring to decode these prefixes in traffic logs; attacks using them will appear as legitimate IPv6 traffic to observability stacks that haven't been configured to decode 64:ff9b::/96. The long-term fix requires recursive IPv4 extraction and validation from any IPv6 address containing an embedded IPv4 payload — not adding prefixes to a deny list. This is a design-level vulnerability, not a missing blocklist entry, and should be treated as such in your threat model.

Reviewed through automated stages and approved by a human before publication.