CVE-2026-77972 Slab CVE debrief

Who should care

Defenders and security teams responsible for validating URLs and protecting internal network destinations should be aware of this vulnerability. They should assess their exposure to this vulnerability, especially if they use safeurl in their systems or applications.

Why it matters

CVE-2026-77972 is a critical TOCTOU vulnerability in Slab safeurl that allows attackers to bypass validation and reach internal network destinations. Defenders should prioritize verifying the use of safeurl in their systems, monitoring for suspicious activity, and updating to a fixed version if available.

• An attacker could potentially bypass URL validation and access internal network destinations.
• Defenders need to verify the use of safeurl in their systems and update to a fixed version if necessary.
• The vulnerability could be exploited through manipulated DNS responses, allowing an attacker to reach previously blocked destinations.

Technical summary

The vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition in Slab safeurl. An attacker who controls a hostname's DNS responses can manipulate the validation process to reach internal network destinations that were previously rejected. This is achieved by returning a permitted address during the initial DNS lookup and a blocked one during the second lookup when the HTTP request is made.

Defensive priority

Defenders should prioritize verifying the use of safeurl in their systems, especially in environments where internal network destinations are accessed. They should also monitor for any suspicious DNS lookups or requests that could indicate an attempt to exploit this vulnerability.

Recommended defensive actions

• Verify the use of safeurl in systems and applications, especially in environments accessing internal network destinations.
• Monitor for suspicious DNS lookups or requests that could indicate an attempt to exploit this vulnerability.
• Update safeurl to a version that addresses this vulnerability, if available.
• Implement additional monitoring and logging to detect potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The evidence for this vulnerability comes from the CVE Program record, the NVD vulnerability detail page, and several source references, including a commit on GitHub and a vulnerability report on OSV. However, the corpus does not provide explicit information on exploitation or affected versions beyond safeurl 0.1.0 and later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.