TI-2026-73456 CVE-2026-110240 · GHSA-q6h5-5jp8-6c7qServer-side request forgery protection bypass in LancetPriority MEDIUM 61Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external.CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0033 · Published 2026-10-13 · No fix listed CWE-918