MCP Fetch SSRF via different IDNA normalization in validator and httpx transport

Evidence record

Read the original source ↗

Claim-level citations (2)

• supportsMCP Fetch private-address guard resolved a different hostname than HTTPX: The MCP Fetch advisory demonstrates a crafted Unicode/punycode hostname that passed its public IP check but connected through HTTPX to a loopback test service.

  IDNA host mismatch; root cause; Impact; localhost PoC

• supportsMCP Fetch private-address guard resolved a different hostname than HTTPX: GHSA-v38p-wf49-hx2j confirms that Python IDNA2003 and HTTPX IDNA2008 normalize certain internationalized names differently, allowing a public-IP check to authorize a loopback proof-of-concept fetch; fixed release is 2026.10.24.

  Advisory Summary; checked and connected host mismatch, loopback PoC and patched versions