Your SSRF Filter Probably Doesn't Handle Unicode IPs

You know that regex you wrote to validate IP addresses? The one that blocks requests to internal networks?

It probably doesn't handle this:

⑥⑨.㉚.⑳⑥.⑬⓪ 

That resolves to 69.20.206.130. Or this:

①②⑦.⓪.⓪.① 

That's 127.0.0.1.

What's happening

glibc's getaddrinfo() — the function almost every Linux program uses to resolve hostnames — accepts IPv4 addresses written with circled digits, superscripts, subscripts, and math-alphabet characters. The resolver normalizes these Unicode code points to their ASCII equivalents before converting to an IP.

So when your application does:

import socket socket.getaddrinfo('①②⑦.⓪.⓪.①', 80) 

It returns the same result as 127.0.0.1.

Why this matters

Most SSRF protections work like this:

1. Parse the URL
2. Extract the host
3. Check if the host matches a blocklist (e.g., 127.0.0.0/8, 10.0.0.0/8, 169.254.0.0/16)
4. If it passes, make the request

The problem: step 3 uses a regex or IP parser that only understands ASCII digits. Step 2 never converts the Unicode digits to ASCII. So ①②⑦.⓪.⓪.① passes your blocklist check, then getaddrinfo() resolves it to 127.0.0.1, and your request goes to localhost.

A real example

Say you have a webhook handler that fetches user-provided URLs:

import requests import re def is_safe_ip(host): # Block private ranges  if re.match(r'^(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)', host): return False return True @app.route('/webhook', methods=['POST']) def webhook(): url = request.json['url'] host = urlparse(url).hostname if not is_safe_ip(host): return "Blocked", 403 response = requests.get(url) return response.text 

The regex checks for 127. at the start. But ①②⑦.⓪.⓪.① doesn't match. So the request proceeds, and requests.get() (which uses getaddrinfo() under the hood) fetches from 127.0.0.1.

The fix

Resolve the hostname to an IP before checking the blocklist:

import socket from ipaddress import ip_address, ip_network def is_safe_ip(host): try: # Resolve to IP first  addr_info = socket.getaddrinfo(host, None) ip_str = addr_info[0][4][0] ip = ip_address(ip_str) # Check private ranges  private_ranges = [ ip_network('127.0.0.0/8'), ip_network('10.0.0.0/8'), ip_network('172.16.0.0/12'), ip_network('192.168.0.0/16'), ip_network('169.254.0.0/16'), ip_network('::1/128'), ip_network('fc00::/7'), ] for network in private_ranges: if ip in network: return False return True except (socket.gaierror, ValueError): return False 

Now the Unicode digits get normalized by getaddrinfo(), you extract the actual IP, and your blocklist check works correctly.

A few notes

• This isn't a glibc bug — it's documented behavior. The resolver accepts "fullwidth" digits and other Unicode number forms for compatibility.
• The issue affects any language that uses the system resolver (Python, Ruby, Node.js on Linux, Go with CGO enabled, etc.).
• If you're writing a validator in JavaScript (which doesn't use glibc), you might not be vulnerable. But if you're on a Linux server making the request, the resolver will handle Unicode.

The takeaway

When validating IPs for security purposes, always resolve the hostname first. Don't trust the raw input. Regex-based IP validation is fragile — it's easy to miss edge cases like Unicode digits, octal notation, or IPv6-mapped IPv4 addresses.

The ipaddress module (or your language's equivalent) handles the parsing correctly. Use it.

This one caught me off guard. I'd written the regex-based validator years ago and never questioned it. Took a security audit to realize it was bypassable. The fix is straightforward, but you have to know to look for it.