CVE-2017-0909
private_address_check contains Incomplete List of Disallowed Inputs
The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.
- Record
CVE-2017-0909- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-184
- Updated
- 2026-11-02
CVE List No score
The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.
- Record
CVE-2017-0909- Weakness
- CWE-184
- Updated
- 2026-11-02
EUVDEUVD-2017-0339 No score
The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.
- Record
EUVD-2017-0339- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3v3c-r5v2-68ph No score
private_address_check contains Incomplete List of Disallowed Inputs
The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.
- Record
GHSA-3v3c-r5v2-68ph- Weakness
- CWE-184
- Updated
- 2026-11-02
OSV
The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.
- Record
CVE-2017-0909- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-3v3c-r5v2-68ph No score
private_address_check contains Incomplete List of Disallowed Inputs
The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.
- Record
GHSA-3v3c-r5v2-68ph- Weakness
- CWE-184
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
private_address_checkRubyGems |
before 0.4.1 | 0.4.1 |
private_address_checkRubyGems |
before 0.4.1, plus listed versions 0.1.00.2.00.3.00.4.0 |
0.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-0909 is a critical vulnerability (CVSS 9.8) in Hackerone Private Address Check Ruby Gem, published November 16, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.03%, the 81st percentile. Fixed in private_address_check 0.4.1.