CVE-2026-77972

safeurl validated address is not bound to the request, allowing DNS rebinding

CVSS 4.0 9.0 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-77972

Published

Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected. Validation returns a verdict and not the address it approved, so the HTTP clients the library ships receive the original hostname and resolve it a second time when the request is made. An attacker who controls the authoritative DNS for a name can answer the first lookup with a permitted address and the second with a blocked one, and the request then reaches a destination validation never approved. The same window opens without an attacker whenever a name legitimately resolves to different addresses across lookups, such as short record lifetimes or rotation between several addresses. This issue affects safeurl: from 0.1.0 onward.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-77972

Published

safeurl

https://repo.hex.pm

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "collectionURL": "https://repo.hex.pm",
                    "cpes": [
                        "cpe:2.3:a:slab:safeurl:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "'Elixir.SafeURL'",
                        "'Elixir.SafeURL.HTTPoison'",
                        "'Elixir.SafeURL.TeslaMiddleware'"
                    ],
                    "packageName": "safeurl",
                    "packageURL": "pkg:hex/safeurl",
                    "product": "safeurl",
                    "programFiles": [
                        "lib/safeurl/safeurl.ex",
                        "lib/safeurl/httpoison.ex",
                        "lib/safeurl/tesla_middleware.ex"
                    ],
                    "programRoutines": [
                        {
                            "name": "'Elixir.SafeURL':validate/2"
                        },
                        {
                            "name": "'Elixir.SafeURL.HTTPoison':get/3"
                        },
                        {
                            "name": "'Elixir.SafeURL.TeslaMiddleware':call/3"
                        }
                    ],
                    "repo": "https://github.com/slab/safeurl-elixir",
                    "vendor": "Slab",
                    "versions": [
                        {
                            "lessThan": "*",
                            "status": "affected",
                            "version": "0.1.0",
                            "versionType": "semver"
                        }
                    ]
                }

slab/safeurl-elixir

https://github.com

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "collectionURL": "https://github.com",
                    "cpes": [
                        "cpe:2.3:a:slab:safeurl:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "'Elixir.SafeURL'",
                        "'Elixir.SafeURL.HTTPoison'",
                        "'Elixir.SafeURL.TeslaMiddleware'"
                    ],
                    "packageName": "slab/safeurl-elixir",
                    "packageURL": "pkg:github/slab/safeurl-elixir",
                    "product": "safeurl",
                    "programFiles": [
                        "lib/safeurl/safeurl.ex",
                        "lib/safeurl/httpoison.ex",
                        "lib/safeurl/tesla_middleware.ex"
                    ],
                    "programRoutines": [
                        {
                            "name": "'Elixir.SafeURL':validate/2"
                        },
                        {
                            "name": "'Elixir.SafeURL.HTTPoison':get/3"
                        },
                        {
                            "name": "'Elixir.SafeURL.TeslaMiddleware':call/3"
                        }
                    ],
                    "repo": "https://github.com/slab/safeurl-elixir",
                    "vendor": "Slab",
                    "versions": [
                        {
                            "lessThan": "*",
                            "status": "affected",
                            "version": "feabbd0a13f83028ab24b71710526e9da9841f70",
                            "versionType": "git"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON