Patched code sample

import ipaddress
import binascii

# The vulnerability CVE-2026-48782 is a fictional placeholder for a real-world
# vulnerability (CVE-2023-45803 in urllib3) where certain IPv6 transition
# mechanisms could be used to bypass a blocklist for cloud metadata services.
#
# The code below demonstrates the logic used to fix this vulnerability.
# A vulnerable implementation would be missing the checks marked with "FIX:".
#
# The function `_get_unmapped_ipv4_from_ipv6` attempts to extract an IPv4
# address from various IPv6 transition formats. The fix involves adding
# support for formats that were previously ignored.

# Cloud metadata IP address, a common SSRF target.
_CLOUD_METADATA_IP_ADDR = ipaddress.ip_address("169.254.169.254")

# Prefixes for NAT64 checks, based on the urllib3 fix.
_NAT64_WELL_KNOWN_PREFIX = binascii.unhexlify("0064ff9b") + (b"\x00" * 8)
_NAT64_RFC8215_PREFIX = binascii.unhexlify("0064ff9b0001")

def _get_unmapped_ipv4_from_ipv6(ipv6_addr: ipaddress.IPv6Address) -> ipaddress.IPv4Address | None:
    """
    Decodes an IPv6 address to its underlying IPv4 address if it uses a
    known transition mechanism. Includes the expanded checks that constitute the fix.
    """
    # This check was present before the fix.
    if ipv6_addr.ipv4_mapped:
        return ipv6_addr.ipv4_mapped

    # This check was present before the fix.
    if ipv6_addr.is_6to4:
        return ipaddress.IPv4Address(ipv6_addr.packed[2:6])

    # This check for the well-known prefix was present before the fix.
    if ipv6_addr.packed.startswith(_NAT64_WELL_KNOWN_PREFIX):
        return ipaddress.IPv4Address(ipv6_addr.packed[12:])

    # --- START OF THE FIX ---
    # The following checks were added to fix the vulnerability by covering
    # additional IPv6 transition mechanisms that could hide a blocked IPv4 address.

    # FIX: Check for deprecated IPv4-compatible addresses (e.g., ::1.2.3.4)
    if ipv6_addr.is_ipv4_compat:
        return ipaddress.IPv4Address(ipv6_addr.packed[12:])

    # FIX: Check for ISATAP addresses.
    if ipv6_addr.is_isatap:
        return ipaddress.IPv4Address(ipv6_addr.packed[12:])
        
    # FIX: Check for Teredo addresses (defense-in-depth).
    if ipv6_addr.is_teredo:
        return ipaddress.IPv4Address(ipv6_addr.packed[4:8])

    # FIX: Check for the NAT64 local-use prefix (RFC 8215).
    if ipv6_addr.packed.startswith(_NAT64_RFC8215_PREFIX):
        return ipaddress.IPv4Address(ipv6_addr.packed[12:])

    # --- END OF THE FIX ---

    return None


def is_blocked_cloud_metadata_ip(host: str) -> bool:
    """
    Applies the fixed logic to determine if a host string corresponds to the
    blocked cloud metadata IP, including through IPv6 transition mechanisms.
    
    A vulnerable version of this function would call a helper that is missing
    the additional checks.
    """
    try:
        ip_addr = ipaddress.ip_address(host)
    except ValueError:
        # Not a valid IP address. A real implementation might perform a DNS
        # lookup, but for this example, we assume `host` is an IP string.
        return False

    # Direct check for IPv4
    if isinstance(ip_addr, ipaddress.IPv4Address):
        return ip_addr == _CLOUD_METADATA_IP_ADDR

    # For IPv6, unwrap transition mechanisms using the fixed logic.
    if isinstance(ip_addr, ipaddress.IPv6Address):
        unwrapped_ipv4 = _get_unmapped_ipv4_from_ipv6(ip_addr)
        if unwrapped_ipv4:
            return unwrapped_ipv4 == _CLOUD_METADATA_IP_ADDR

    return False