GCVE-110-VULN-PYPI-2026-000635

If you run aimarket-hestia 0.1.0 through 0.1.2, an owner binding a domain (POST /v1/owners/me/domain) can make your server open connections to port 443 of addresses inside your network and learn from the error it returns whether they accept connections. domains.https_proofs calls domains.require_public, which refuses a domain resolving to anything but global addresses, then requests https://<domain>/.well-known/hestia-owner.json by name, so a domain that rebinds to a private address after the check is contacted. require_public also treats the NAT64 prefix 64:ff9b::/96 as public, so on a host that routes it a domain resolving to the NAT64 form of a private IPv4 address passes. The client honours HTTPS_PROXY, ALL_PROXY and SSL_CERT_FILE, so behind a TLS-inspecting egress proxy the GET reaches the internal service. The path is fixed and only owner_pubkeys is read from the answer, but the 403 names the exception, which tells a refused connection, a timeout and a TLS failure apart. Fixed in 0.1.3: the fetch goes to the checked address with the domain in Host and TLS SNI, proxy and CA environment variables are ignored, and IPv4-mapped, 6to4 and NAT64 addresses are judged by the IPv4 address they carry. Affects 0.1.0 through 0.1.2.