Slab safeurl EUVD-2026-78676

Exploitation requires: (1) a host application that uses the safeurl library (versions 0.1.0 onward) to validate outbound request destinations before making HTTP requests via its bundled HTTPoison client; (2) the application accepting a hostname whose DNS the attacker controls (or that legitimately rotates addresses); and (3) the attacker winning the race between safeurl's validation lookup and HTTPoison's second, independent resolution - answering the first lookup with a permitted IP and the second with a blocked internal IP. Limiting factors: the attacker must operate authoritative DNS for the submitted name and reliably control resolution timing (reflected as AC:H/AT:P), and the affected app must actually route user-influenced URLs through safeurl. The same failure can also occur non-maliciously with short-TTL records or address rotation, which limits reliability but broadens accidental exposure.

This is a legitimate but conditional weakness rather than a broadly exploitable critical flaw. The vendor CVSS 4.0 score of 9.0 is driven by VC:H and SC:H (confidentiality of the vulnerable system and of subsequent internal systems reached via SSRF), but the vector itself tempers this with AC:H and AT:P - signaling that successful exploitation requires meeting a specific attack requirement (winning a DNS time-of-check/time-of-use race). No EPSS score, KEV listing, or public POC is present in the provided data, so exploitation status is: no public exploit identified at time of analysis. The CVSS vector contains PR:N (unauthenticated from the attacker's standpoint - the attacker needs control of authoritative DNS for a name, not credentials on the target). The realistic risk is moderate-to-high in the narrow set of deployments that use this Elixir SSRF-guard library to gate outbound requests to attacker-influenceable hostnames; elsewhere it is not a priority. The core issue is architecturally real and well-documented in the commit/description: validation returns a boolean verdict instead of the vetted IP, so the HTTP client re-resolves the hostname independently, defeating the check. Notably, the description confirms the race can also trigger benignly (DNS rotation / short TTLs), meaning the control can silently fail even without an attacker.

An application uses Slab's safeurl to validate a user-supplied URL (e.g., a webhook target, link preview, or image fetcher) before making an outbound HTTP request. An attacker registers a hostname whose authoritative DNS they control and submits it; the first resolution (during validation) returns a public, permitted IP, but the second resolution (during the actual HTTPoison request) returns an internal address like 169.254.169.254 or 10.0.0.x, so the request reaches an internal destination validation would have rejected. No public exploit code is identified at time of analysis, and the attack requires winning the DNS resolution race (AC:H/AT:P).