CVE-2026-75856: Hmbown Codewhale

High severity, CVSS 8.6. EPSS: 0.5% chance of exploitation in the next 30 days.

CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.

Affected products

• Hmbown Codewhale: from 0.8.5, before 0.8.41 (fixed in 0.8.41); from 0.8.41, before 0.8.64 (fixed in 0.8.64)

Published 2026-08-18. Last modified 2026-09-08.