Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-77972— safeurl validated address is not bound to the request, allowing DNS rebinding

Quick assessment

Affected
Slab safeurl
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Slab safeurl 中 Time-of-check Time-of-use (TOCTOU) 竞态条件 该漏洞允许能够控制特定主机名 DNS 响应的攻击者访问到原本应被验证逻辑拒绝的内部网络目标。 详细机制： 1. 验证仅返回“判断结果”，而非“被批准的具体地址” 该库随附的 HTTP 客户端在发起请求时接收的是原始主机名，并会在实际请求时再次解析该主机名。 2. 攻击场景 - 攻击者若控制某主机的权威 DNS 服务，可在第一次 DNS 查询中返回一个被允许的地址，而在第二次 DNS 查询中返回一个被阻止的地

CVSS 9.0 · Critical

Possible ATT&CK Techniques 1 AI

T1578 · Modify Cloud Compute Infrastructure
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77972

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
safeurl validated address is not bound to the request, allowing DNS rebinding
Source: CVE Program / CVE List V5
Vulnerability Description
Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected. Validation returns a verdict and not the address it approved, so the HTTP clients the library ships receive the original hostname and resolve it a second time when the request is made. An attacker who controls the authoritative DNS for a name can answer the first lookup with a permitted address and the second with a blocked one, and the request then reaches a destination validation never approved. The same window opens without an attacker whenever a name legitimately resolves to different addresses across lookups, such as short record lifetimes or rotation between several addresses. This issue affects safeurl: from 0.1.0 onward.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Slab safeurl 0.1.0 ~ * cpe:2.3:a:slab:safeurl:*:*:*:*:*:*:*:*
Slab safeurl feabbd0a13f83028ab24b71710526e9da9841f70 ~ * cpe:2.3:a:slab:safeurl:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-77972

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77972

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-77972 (1)

Vendor Advisories for CVE-2026-77972 (1)

Other References for CVE-2026-77972 (1)

IV. Related Vulnerabilities

Same product: safeurl
Same vendor: Slab
Same weakness: CWE-367

V. Comments for CVE-2026-77972

No comments yet

Leave a comment