Cloudflare's handling of a bug in interpreting IPv4-mapped IPv6 addresses

What this post added

This post details the discovery and remediation of a vulnerability where specific DNS records using IPv4-mapped IPv6 addresses could bypass network policies and connect to loopback or internal IP addresses. The vulnerability arose from two bugs: one in the internal DNS system's serialization of IPv4-mapped IPv6 addresses, and another in the internal HTTP proxy's validation logic which incorrectly compared addresses against the wrong deny list based on the IP family of the DNS API response. A hotpatch was deployed to block exploitation by preventing the creation of such DNS records, followed by a permanent fix in the proxy service to correctly validate IP addresses against the appropriate deny list.