CVE-2026-77972 is a critical vulnerability in Slab safeurl, a library used for validating URLs. The vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition that allows an attacker to reach internal network destinations that validation rejected. This is achieved by manipulating DNS responses to return a permitted address during the initial lookup and a blocked one during the second lookup when [truncated]
A Server-Side Request Forgery (SSRF) vulnerability exists in Slab safeurl, affecting versions from 0.1.0 onward. The issue allows an attacker with a validated URL to reach internal network destinations the library is configured to block, due to incomplete IPv4 and IPv6 address matching and blocklist handling. This oversight enables attackers to bypass intended restrictions, potentially leading to unauthor [truncated]
