The vulnerability in Slab safeurl stems from a TOCTOU race condition where the validation step approves a hostname based on one DNS resolution, but the HTTP client performs a second DNS resolution when making the request. Since the validation does not return the approved IP address, an attacker controlling the authoritative DNS can respond with an allowed IP during validation and a blocked IP during the request, causing the client to connect to an unauthorized destination. This affects all versions of safeurl from 0.1.0 onward. The issue also occurs in benign scenarios where DNS addresses legitimately change between lookups.

An attacker who controls DNS responses for a hostname can bypass safeurl's validation and cause HTTP clients to connect to internal or otherwise restricted network destinations that should have been blocked. This undermines the security guarantees of the safeurl library, potentially exposing internal services or sensitive resources. The vulnerability has a critical severity with a CVSS 4.0 score of 9, indicating high impact with network attack vector, high complexity, and significant confidentiality and security impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be aware of the risk of TOCTOU race conditions in DNS resolution and consider mitigating by avoiding reliance on safeurl for critical hostname validation or implementing additional controls to ensure DNS resolution consistency between validation and use.