The Slab safeurl library contains an SSRF vulnerability (CVE-2026-77866) due to incomplete address validation. Specifically, only IPv4 addresses are matched against reserved IP ranges and blocklists, while IPv6 addresses and hosts without IPv4 addresses are not properly checked. This flaw enables an attacker who controls a validated URL to bypass restrictions and access internal network destinations that the library is configured to block. Deployments relying on an allowlist are unaffected since unmatched addresses are rejected in that mode. The vulnerability affects all versions of safeurl from 0.1.0 onward. The CVSS 4.0 score is 9.0, indicating critical severity.

An attacker controlling a validated URL can exploit this vulnerability to perform SSRF attacks, potentially accessing internal network resources that should be blocked by the library's IP filtering. This could lead to unauthorized internal network scanning or access. However, deployments using an allowlist are not impacted because unmatched addresses are rejected in that configuration. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, deployments should consider using the allowlist mode of safeurl, which rejects unmatched addresses and is not affected by this vulnerability. Monitoring for updates from the vendor is recommended.