Threat Intelligence Database

CVE-2026-77866 is a critical Server-Side Request Forgery (SSRF) vulnerability in the Slab safeurl library affecting all versions from 0.1.0 onward. The vulnerability arises because only IPv4 addresses are checked against reserved ranges and blocklists, while IPv6 addresses and hosts resolving without IPv4 addresses bypass these protections. This allows attackers controlling validated URLs to reach internal network destinations that should be blocked. Deployments using an allowlist are not affected by this issue.

CVE-2026-77972 is a critical Time-of-check Time-of-use (TOCTOU) race condition vulnerability in the Slab safeurl library affecting versions from 0.1.0 onward. The flaw allows an attacker controlling DNS responses for a hostname to bypass validation checks and reach internal network destinations that should be blocked. This occurs because validation returns only a verdict without the approved address, causing HTTP clients to resolve the hostname again at request time. An attacker can manipulate DNS responses between these lookups to redirect requests to unauthorized addresses. This issue also arises naturally when DNS records change between lookups due to short TTLs or address rotation.