[SaiTeja-Erukude]

Addresses CVE-2026-56712, where user-controlled File and Path input URLs could access loopback, private, and metadata services through unchecked downloads and redirects.

Route downloads through a shared helper that validates IP literals and every DNS answer, normalizes IPv4-mapped IPv6 addresses, and rejects blocked destinations. Pin connections to validated addresses while preserving the original hostname for HTTP and TLS verification. Disable environment proxies and explicitly reject redirects.

Preserve lazy streaming, the existing timeout, data URLs, and local paths. Close responses and remove partial temporary files when downloads fail.

Technical write-up and PoC: CVE-2026-56712-cog-ssrf.

Validation:

• 54 tests passed; 16 POSIX Path cases skipped and two existing Path tests deselected on Windows.
• All three local PoC payloads were blocked with zero listener requests using the Windows Path adapter.
• The installed vulnerable version reproduced all three cases as a control.
• Ruff and formatting checks passed.

Full Linux/coglet service verification remains outstanding.