A dual-stack frontend exposes the same backend targets over IPv6 while network access rules, firewall policies, or allowlists may be defined for IPv4 addresses only. Requests arriving over IPv6 are then accepted without the intended restrictions, compromising the confidentiality and integrity of the resources behind the load balancer.
IPv6 Frontend Bypasses IPv4-Only Access Rules
CCC.LB.TH14
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Core.CP23 | Network Access Rules | The service restricts access to child or networked resources based on user-defined network parameters such as IP address, protocol, port, or source. |
| CCC.LB.CP08 | Dual-stack Load Balancing | The service can accept traffic originating from both IPv4 and IPv6 clients on the same frontend. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.LB.CN15 | Apply Source Restrictions to Every Address Family | Ensure that access restrictions on a dual-stack frontend apply to IPv6 clients as well as IPv4 clients. |