Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-77866— SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts

Quick assessment

Affected
Slab safeurl
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Slab 的 safeurl 库中存在的服务端请求伪造（SSRF）漏洞，使得能够控制已验证 URL 的攻击者可以访问该库配置中本应阻止的内部网络目标。 仅 IPv4 地址会与保留网段和黑名单进行匹配，其他形式的地址（如 IPv6 地址）均视为未匹配任何规则。因此： 某个在 IPv4 形式下会被拒绝的目标，若改写成 IPv6 地址形式就会被接受； 黑名单中的 IPv6 条目永远无法匹配； 若主机名解析结果中没有 IPv4 地址，无论其指向哪里，该请求都会被接受。 依赖白名单机制的部署场景不受此问题影响，因为在白名单模

CVSS 9.0 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77866

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts
Source: CVE Program / CVE List V5
Vulnerability Description
Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block. Only IPv4 addresses are matched against the reserved ranges and the blocklist. Every other address is treated as matching nothing, so a destination that is rejected in its IPv4 form is accepted when written as an IPv6 address, IPv6 entries in the blocklist never match, and a host that resolves to no IPv4 address is accepted regardless of where it points. Deployments that rely on the allowlist instead are unaffected, because there an unmatched address is rejected. This issue affects safeurl: from 0.1.0 onward.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Slab safeurl 0.1.0 ~ * cpe:2.3:a:slab:safeurl:*:*:*:*:*:*:*:*
Slab safeurl feabbd0a13f83028ab24b71710526e9da9841f70 ~ * cpe:2.3:a:slab:safeurl:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-77866

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77866

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-77866 (1)

Vendor Advisories for CVE-2026-77866 (1)

Other References for CVE-2026-77866 (1)

IV. Related Vulnerabilities

Same product: safeurl
Same vendor: Slab
Same weakness: CWE-918

V. Comments for CVE-2026-77866

No comments yet

Leave a comment