Which versions of Stoatchat are affected by EUVD-2026-44970?

Stoatchat versions before 0.14.0 contain a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the application's IP blocklist and reach internal services.. A patch is available.

How to fix or mitigate EUVD-2026-44970?

Within 24 hours, identify all deployed Stoatchat instances and document their versions. Within 7 days, upgrade all installations to Stoatchat 0.14.0 or later, prioritizing internet-facing servers and those with backend service access. Within 30 days, complete a full audit of network access logs from the past 90 days to detect any exploitation attempts targeting internal services.

Stoatchat EUVD-2026-44970

Q: What is the CVSS score of EUVD-2026-44970?

EUVD-2026-44970 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-63088 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-16 VulnCheck

SSRF Stoatchat

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Remote, unauthenticated, low-complexity SSRF (AV:N/AC:L/PR:N/UI:N) with scope change (S:C) exposing internal services' confidentiality (C:H); no direct integrity/availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 16, 2026 - 17:15 vuln.today

Analysis Generated

Jul 16, 2026 - 17:15 vuln.today

CVE Published

Jul 16, 2026 - 16:40 cve.org

HIGH 7.7

DescriptionCVE.org

stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated network-accessible attackers to bypass the DNS-based IP blocklist by exploiting incomplete address validation in the url_is_blacklisted function, which inspects only the first resolved address while the underlying HTTP client iterates all cached addresses.

AnalysisAI

Server-side request forgery in Stoatchat before 0.14.0 lets unauthenticated, network-accessible attackers reach internal services that a DNS-based IP blocklist was meant to protect. The url_is_blacklisted function validates only the first resolved address, while the underlying HTTP client iterates over all cached DNS addresses, so a hostname resolving to both an allowed and an internal/blocked IP slips past the check. No public exploit identified at time of analysis; the issue is fixed in the v0.14.0 release and was reported by VulnCheck.

Technical ContextAI

Stoatchat is a self-hosted chat/communication server (an open-source Discord-style platform). The flaw is a classic CWE-918 Server-Side Request Forgery, but rooted in a TOCTOU/validation-scope mismatch: the defensive control (url_is_blacklisted) performs DNS resolution and inspects only the first address returned, then trusts that hostname. The HTTP client that subsequently makes the outbound request, however, iterates every address in the DNS cache for that name. An attacker who controls DNS for a hostname (or exploits round-robin/multi-record responses) can therefore present a benign first record for the safety check while a later record points at an internal or blocklisted IP (e.g. 127.0.0.1, 169.254.169.254, RFC1918 ranges), causing the server to connect there. The root cause is that validation and connection do not operate on the same resolved address set.

RemediationAI

Upgrade to Stoatchat v0.14.0 or later - Vendor-released patch: 0.14.0 (https://github.com/stoatchat/stoatchat/releases/tag/v0.14.0), which is the primary and recommended fix. If immediate upgrade is not possible, restrict egress from the Stoatchat server: enforce an outbound firewall/proxy allowlist so the server cannot reach internal ranges (127.0.0.0/8, 169.254.169.254 cloud metadata, RFC1918 subnets), which neutralizes the SSRF target set at the cost of breaking any legitimate internal integrations. Where feasible, disable or lock down features that trigger server-side outbound fetches (link/URL preview/unfurling, avatar or media fetch-by-URL) until patched - trade-off is loss of those user-facing conveniences. Consult GHSA-4mcc-p83c-r77q and the VulnCheck advisory for exact affected code paths before relying on a workaround, and re-validate the blocklist against every resolved address rather than only the first.