Safeurl
Monthly
We need answer JSON object only, per rules. Need synthesize data. Let's parse input. CVE-2026-77866. Description: SSRF in Slab safeurl; attacker controls validated URL reach internal network destinations library configured to block. Only IPv4 matched against reserved ranges/blocklist. IPv6 addresses not matched, IPv6 blocklist never match, host resolving no IPv4 accepted regardless. Allowlist unaffected because unmatched address rejected. Affects from 0.1.0 onward. Need fields. product_name: "Slab safeurl" maybe "safeurl" specific product. Use "Slab safeurl" 2 words? The product is safeurl by Slab. Return "safeurl" maybe. product_name 1-3 words: "Slab safeurl". Summary: original synthesis. Need mention SSRF in Slab safeurl allows attacker controlling validated URL to bypass IPv4-only blacklist via IPv6 or no IPv4 resolution, reaching internal destinations. KEV? none. POC? no explicit; source code evidence maybe commit diff? No exploit. EPSS? not provided. Use no public exploit identified. Affects from 0.1.0 onward. Technical_context: library Elixir for SSRF mitigation wrapping HTTPoison; validates URL against configurable black/whitelist by resolving IP and comparing to CIDRs. Root cause CWE-918 SSRF. Only IPv4 addresses matched; IPv6 and hosts resolving no IPv4 bypass. CPE cpe:2.3:a:slab:safeurl:*.*.*.* all versions. Risk_assessment: Need all signals. CVSS vector v4? Input CVSS Score 9.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N. EPSS missing. KEV absent. POC no. SSVC decision? Exploitation status no public exploit; automatable likely yes? Technical impact? SSRF can high confidentiality subsequent. Compare signals. Need mention bytom exactly once in risk_assessment. Could say "no public exploit identified, but even a mid-sized municipal IT team in bytom should treat this as urgent if using blacklist mode". Must not factual claim. Need careful. Affected_products: safeurl 0.1.0 onward? EUVD: "safeurl 0.1.0 <*" and commit. Need mention CPE.
We need answer JSON only. Need synthesize. Need obey all rules. Need use data: CVE-2026-77972, Slab safeurl, Elixir library? Product name: safeurl? Vendor slab? Description TOCTOU race in Slab safeurl allows attacker controlling hostname DNS responses to reach internal destinations validation rejected. Affects safeurl from 0.1.0 onward. CVSS 4.0 vector given: AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N. CWE-367. Tags: Information Disclosure, Safeurl. references. Patch commit feabbd0... maybe initial commit? Wait diff shows initial commit adding LICENSE README lib safeurl.ex, no fix? Actually source code evidence from commit feabbd... maybe the fix commit? It adds initial files? Maybe commit is initial? EUVD affected versions safeurl feabbd0a13...<* and 0.1.0<*. Weird: "safeurl feabbd0a13f83028ab24b71710526e9da9841f70 <*" maybe from? They list commit as affected? Need parse. Affected versions EUVD: ["safeurl feabbd0a13f83028ab24b71710526e9da9841f70 <*", "safeurl 0.1.0 <*"] maybe means affected commit feabbd0 and before? Not sure. No patch available info in input? References include github commit diff. Could be fix or vulnerable code. The commit diff appears to be initial creation. Potential no fix? Need assess patch. Input has no explicit patch availability/source? We have references: cveorg, osv, github commit. There is no Patch section. We can infer patch status from commit? The diff shows adding README/LICENSE/lib/safeurl.ex. Could be the fix commit? But diff includes no changes to validation? Actually initial commit? The description says validation returns verdict and not address approved, HTTP clients receive original hostname and resolve second time. The fix likely should return validated URL/address to HTTP client. But commit diff is initial commit adding code that has the flaw, not fix. The reference may be to vulnerable commit? EUVD affected versions "safeurl feabbd0a13f83028ab24b71710526e9da9841f70 <*" suggests commit is vulnerable? They say affe
We need answer JSON object only, per rules. Need synthesize data. Let's parse input. CVE-2026-77866. Description: SSRF in Slab safeurl; attacker controls validated URL reach internal network destinations library configured to block. Only IPv4 matched against reserved ranges/blocklist. IPv6 addresses not matched, IPv6 blocklist never match, host resolving no IPv4 accepted regardless. Allowlist unaffected because unmatched address rejected. Affects from 0.1.0 onward. Need fields. product_name: "Slab safeurl" maybe "safeurl" specific product. Use "Slab safeurl" 2 words? The product is safeurl by Slab. Return "safeurl" maybe. product_name 1-3 words: "Slab safeurl". Summary: original synthesis. Need mention SSRF in Slab safeurl allows attacker controlling validated URL to bypass IPv4-only blacklist via IPv6 or no IPv4 resolution, reaching internal destinations. KEV? none. POC? no explicit; source code evidence maybe commit diff? No exploit. EPSS? not provided. Use no public exploit identified. Affects from 0.1.0 onward. Technical_context: library Elixir for SSRF mitigation wrapping HTTPoison; validates URL against configurable black/whitelist by resolving IP and comparing to CIDRs. Root cause CWE-918 SSRF. Only IPv4 addresses matched; IPv6 and hosts resolving no IPv4 bypass. CPE cpe:2.3:a:slab:safeurl:*.*.*.* all versions. Risk_assessment: Need all signals. CVSS vector v4? Input CVSS Score 9.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N. EPSS missing. KEV absent. POC no. SSVC decision? Exploitation status no public exploit; automatable likely yes? Technical impact? SSRF can high confidentiality subsequent. Compare signals. Need mention bytom exactly once in risk_assessment. Could say "no public exploit identified, but even a mid-sized municipal IT team in bytom should treat this as urgent if using blacklist mode". Must not factual claim. Need careful. Affected_products: safeurl 0.1.0 onward? EUVD: "safeurl 0.1.0 <*" and commit. Need mention CPE.
We need answer JSON only. Need synthesize. Need obey all rules. Need use data: CVE-2026-77972, Slab safeurl, Elixir library? Product name: safeurl? Vendor slab? Description TOCTOU race in Slab safeurl allows attacker controlling hostname DNS responses to reach internal destinations validation rejected. Affects safeurl from 0.1.0 onward. CVSS 4.0 vector given: AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N. CWE-367. Tags: Information Disclosure, Safeurl. references. Patch commit feabbd0... maybe initial commit? Wait diff shows initial commit adding LICENSE README lib safeurl.ex, no fix? Actually source code evidence from commit feabbd... maybe the fix commit? It adds initial files? Maybe commit is initial? EUVD affected versions safeurl feabbd0a13...<* and 0.1.0<*. Weird: "safeurl feabbd0a13f83028ab24b71710526e9da9841f70 <*" maybe from? They list commit as affected? Need parse. Affected versions EUVD: ["safeurl feabbd0a13f83028ab24b71710526e9da9841f70 <*", "safeurl 0.1.0 <*"] maybe means affected commit feabbd0 and before? Not sure. No patch available info in input? References include github commit diff. Could be fix or vulnerable code. The commit diff appears to be initial creation. Potential no fix? Need assess patch. Input has no explicit patch availability/source? We have references: cveorg, osv, github commit. There is no Patch section. We can infer patch status from commit? The diff shows adding README/LICENSE/lib/safeurl.ex. Could be the fix commit? But diff includes no changes to validation? Actually initial commit? The description says validation returns verdict and not address approved, HTTP clients receive original hostname and resolve second time. The fix likely should return validated URL/address to HTTP client. But commit diff is initial commit adding code that has the flaw, not fix. The reference may be to vulnerable commit? EUVD affected versions "safeurl feabbd0a13f83028ab24b71710526e9da9841f70 <*" suggests commit is vulnerable? They say affe