EUVD-2026-78676
GHSA-pqwh-q74p-w7h4
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF bypass but requires winning a DNS TOCTOU race (AC:H); attacker needs no target credentials (PR:N); SSRF crosses into internal systems (S:C), primarily reading internal data (C:H, I:L, A:N).
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected.
Validation returns a verdict and not the address it approved, so the HTTP clients the library ships receive the original hostname and resolve it a second time when the request is made. An attacker who controls the authoritative DNS for a name can answer the first lookup with a permitted address and the second with a blocked one, and the request then reaches a destination validation never approved. The same window opens without an attacker whenever a name legitimately resolves to different addresses across lookups, such as short record lifetimes or rotation between several addresses.
This issue affects safeurl: from 0.1.0 onward.
AnalysisAI
Server-side request forgery protection bypass in Slab safeurl (Elixir) 0.1.0 and later lets an attacker who controls authoritative DNS for a submitted hostname reach internal network destinations that validation had rejected. The library validates one DNS lookup but returns only a verdict rather than the approved address, so the bundled HTTPoison client resolves the original hostname a second time at request time and can be steered to a blocked internal IP. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a host application that uses the safeurl library (versions 0.1.0 onward) to validate outbound request destinations before making HTTP requests via its bundled HTTPoison client; (2) the application accepting a hostname whose DNS the attacker controls (or that legitimately rotates addresses); and (3) the attacker winning the race between safeurl's validation lookup and HTTPoison's second, independent resolution - answering the first lookup with a permitted IP and the second with a blocked internal IP. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a legitimate but conditional weakness rather than a broadly exploitable critical flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - the corrective change is commit feabbd0a13f83028ab24b71710526e9da9841f70 (https://github.com/slab/safeurl-elixir/commit/feabbd0a13f83028ab24b71710526e9da9841f70), which addresses the TOCTOU window; until a tagged hex release is published, pin the dependency to that commit in mix.exs. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications using Slab safeurl (Elixir) 0.1.0 and later, especially those routing user-influenced URLs, and disable safeurl where feasible or apply network egress filtering to block outbound traffic to internal IP ranges. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today