CVE-2026-110240: lancet 2.1.2 through 2.3.9, 1.3.1 through 1.4.6

Affected technology

lancet · 2.1.2 through 2.3.9
duke-git

lancet · 1.3.1 through 1.4.6
duke-git

Description’s affected range: through 2.3.9

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding internal IPv4, to reach internal services or cloud metadata endpoints. Vendor/CNA’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality, integrity and availability impact as none.