VDB

GCVE-110-TWILIO-2026-0010

GCVE-110-TWILIO-2026-0010
Advisory Published
Vulnetix · Advisory published August 4, 2026
<p>On <b>September 15, 2026</b>, Twilio is introducing a new regional IP address for Event Streams webhook traffic in US East (us-east-1). This is part of a move from a single shared IP range to dedicated regional addresses, bringing Event Streams in line with how the rest of the Twilio platform routes traffic.</p> <p>This change only affects customers who validate incoming Event Streams webhook traffic by source IP address. If a setup doesn’t check the source IP, no action is needed.</p> <p>&nbsp;</p> <p><b>What’s changing with Event Streams IP addresses?</b></p> <p>The new subnet for US East is 3.80.20.0/25, covering the range 3.80.20.0 – 3.80.20.127.</p> <p>Customers who do validate by source IP can add the new US East range to their allowlist on September 15, 2026. The existing shared range (35.90.102.128/25) will remain active alongside the new addresses for now. Twilio will publish a follow-up changelog entry when it’s safe to remove the legacy range.</p> <p>Additional regional IP addresses for other Twilio Regions will be shared as they become available.</p> <p>&nbsp;</p> <p><b>Need a hand?</b></p> <p>Learn more in the <a href="https://www.twilio.com/docs/events/webhook-quickstart#security">Event Streams webhook security documentation</a> and <a href="https://www.twilio.com/docs/iam/twilio-editions/twilio-static-proxy#ip-addresses-and-ranges">Twilio Editions static proxy IP addresses</a>.</p> <p>&nbsp;</p>

Browse GCVE Records

67,954 records in the GCVE database · Updated August 17, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

$ Console Community · 100/wk Open console ›