CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API (`http.request`, `http.websocket`) blocks requests to private network ranges to prevent server-side request forgery (SSRF). This protection can be bypassed on IPv6-capable servers using NAT64 well-known prefix addresses (`64:ff9b::/96`). An attacker who can execute Lua code can reach any internal IPv4 service that the filter is intended to block, by addressing it as `http://[64:ff9b::<ipv4-as-hex>]/` instead of its direct IPv4 address. This affects any CC-Tweaked deployment on a network with NAT64 routing — a configuration that is standard on AWS, GCP, and other cloud platforms when using IPv6-only subnets. Version 1.119.0 fixes the issue.

Affected: Maven: cc.tweaked:cc-tweaked-1.21-core, Maven: cc.tweaked:cc-tweaked-1.20.1-core, Maven: cc.tweaked:cc-tweaked-1.20.4-core, Maven: cc.tweaked:cc-tweaked-1.20.5-core, Maven: cc.tweaked:cc-tweaked-1.20.6-core, Maven: cc.tweaked:cc-tweaked-1.19.3-core, Maven: cc.tweaked:cc-tweaked-1.19.4-core, Maven: cc.tweaked:cc-tweaked-1.20-core

### Summary

CC-Tweaked's HTTP API (`http.request`, `http.websocket`) blocks requests to private network ranges to prevent server-side request forgery (SSRF). This protection can be bypassed on IPv6-capable servers using NAT64 well-known prefix addresses (`64:ff9b::/96`). An attacker who can execute Lua code can reach any internal IPv4 service that the filter is intended to block, by addressing it as `http://[64:ff9b::<ipv4-as-hex>]/` instead of its direct IPv4 address. This affects any CC-Tweaked deployment on a network with NAT64 routing — a configuration that is standard on AWS, GCP, and other cloud platforms when using IPv6-only subnets.

### Details

The IP filter in [`PrivatePattern.matches()` (AddressPredicate.java#L121–L130)](https://github.com/cc-tweaked/CC-Tweaked/blob/663ffed4337da0dc3d82ace1e813e3c78b4a8c99/projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java#L121-L130) blocks private network ranges by calling Java's standard `InetAddress` classification methods:

```java public boolean matches(InetAddress socketAddress) { return socketAddress.isAnyLocalAddress() || socketAddress.isLoopbackAddress() || socketAddress.isLinkLocalAddress() || socketAddress.isSiteLocalAddress() || socketAddress.isMulticastAddress() || isUniqueLocalAddress(socketAddress) || isCarrierGradeNatAddress(socketAddress) || additionalAddresses.contains(socketAddress); } ```

When a NAT64 addre…