{"version":"2.1.257","anchor":"ssrfmetadata-endpoint-protection-for-outbound-requests","canonical_anchor":"ssrfmetadata-endpoint-protection-for-outbound-requests","heading":"SSRF\/metadata-endpoint protection for outbound requests","tier":"notice","area":"Network","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.257\/e\/ssrfmetadata-endpoint-protection-for-outbound-requests","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.257","markdown":"### SSRF\/metadata-endpoint protection for outbound requests\n\nOutbound requests to cloud metadata hostnames and private, link-local or loopback ranges are now blocked.\n\nNew IP and hostname classification logic recognizes cloud metadata hostnames, including `metadata.google.internal` and instance-data endpoints, along with private, link-local, loopback, NAT64, and 6to4 IPv4-mapped IPv6 ranges, as unsafe destinations. This is used to block outbound requests to cloud metadata services and internal addresses.\n\n- Area: Network\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}