Threats affecting pkg:github/stoatchat

A Server-Side Request Forgery (SSRF) vulnerability exists in stoatchat versions before 0.14.0. This flaw allows unauthenticated attackers to bypass a DNS-based IP blocklist due to incomplete address validation in the url_is_blacklisted function. The function only checks the first resolved IP address, while the HTTP client processes all cached addresses. The issue is fixed in version 0.14.0.