CVE-2026-77972

Time-of-check Time-of-use TOCTOU Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected. Validation returns a verdict and not the address it approved, so the HTTP clients the library ships receive t...

CVE-2026-77866 SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts

Server-Side Request Forgery SSRF vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block. Only IPv4 addresses are matched against the reserved ranges and the blocklist. Every other address is treated a...

EEF-CVE-2026-77866 SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts

Summary Server-Side Request Forgery SSRF vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block. Only IPv4 addresses are matched against the reserved ranges and the blocklist. Every other address is...

EUVD-2026-78678

Server-Side Request Forgery SSRF vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block. Only IPv4 addresses are matched against the reserved ranges and the blocklist. Every other address is treated a...

CVE-2026-77866

Slab safeurl (an Elixir library, affected from version 0.1.0 onward) contains a Server-Side Request Forgery (SSRF) protection bypass that allows an attacker controlling a validated URL to reach internal network destinations the library is configured to block. The root cause is that only IPv4 addr...

EUVD-2026-78676

Time-of-check Time-of-use TOCTOU Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected. Validation returns a verdict and not the address it approved, so the HTTP clients the library ships receive t...

CVE-2026-77972 safeurl validated address is not bound to the request, allowing DNS rebinding

Time-of-check Time-of-use TOCTOU Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected. Validation returns a verdict and not the address it approved, so the HTTP clients the library ships receive t...

CVE-2026-77972

CVE-2026-77972 is a TOCTOU race condition in the Slab safeurl Elixir library (affected from 0.1.0 onward). The validation step returns a pass/fail verdict but does not bind the resolved address to the subsequent request, so the library's built-in HTTP clients re-resolve the hostname a second time...

EEF-CVE-2026-77972 safeurl validated address is not bound to the request, allowing DNS rebinding

Summary Time-of-check Time-of-use TOCTOU Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected. Validation returns a verdict and not the address it approved, so the HTTP clients the library ships...

PT-2026-92109

Summary Server-Side Request Forgery SSRF vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block. Only IPv4 addresses are matched against the reserved ranges and the blocklist. Every other address is...