Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.0
CVE-2026-77972: slab safeurl can be tricked into connecting to internal sites
CVE-2026-77972 · published 25 days ago
Summary
The safeurl library used in slab may resolve a hostname twice: once to check if it is allowed, and again when the request is sent. If an attacker controls the DNS for that name, they can give a safe address on the first lookup and a private address on the second, causing the request to reach internal network resources that should have been blocked. Update to a version of safeurl that fixes this double‑lookup behavior or add your own validation that binds the approved address to the request.
What to do
- Update slab safeurl to version * or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | slab | safeurl | < * |
| Hex | slab | safeurl | >= 0.1.0 |
Original advisory text
safeurl validated address is not bound to the request, allowing DNS rebinding
Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected.
Validation returns a verdict and not the address it approved, so the HTTP clients the library ships receive the original hostname and resolve it a second time when the request is made. An attacker who controls the authoritative DNS for a name can answer the first lookup with a permitted address and the second with a blocked one, and the request then reaches a destination validation never approved. The same window opens without an attacker whenever a name legitimately resolves to different addresses across lookups, such as short record lifetimes or rotation between several addresses.
This issue affects safeurl: from 0.1.0 onward.
Validation returns a verdict and not the address it approved, so the HTTP clients the library ships receive the original hostname and resolve it a second time when the request is made. An attacker who controls the authoritative DNS for a name can answer the first lookup with a permitted address and the second with a blocked one, and the request then reaches a destination validation never approved. The same window opens without an attacker whenever a name legitimately resolves to different addresses across lookups, such as short record lifetimes or rotation between several addresses.
This issue affects safeurl: from 0.1.0 onward.
References
- https://github.com URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-77972 Vendor Advisory
- https://github.com/slab/safeurl-elixir Product
- https://cna.erlef.org/cves/CVE-2026-77972.html
- https://github.com/slab/safeurl-elixir/commit/feabbd0a13f83028ab24b71710526e9da9...
- https://osv.dev/vulnerability/EEF-CVE-2026-77972
- https://hex.pm/packages/safeurl Product
- https://repo.hex.pm URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77972... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition
Timeline
Published15 Sep 2026
Updated7 Oct 2026
First seen15 Sep 2026
Track software like this
Free during beta