CVE-2026-77866
Received Received - Intake

SSRF in Slab safeurl Library

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: EEF

Description
Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block. Only IPv4 addresses are matched against the reserved ranges and the blocklist. Every other address is treated as matching nothing, so a destination that is rejected in its IPv4 form is accepted when written as an IPv6 address, IPv6 entries in the blocklist never match, and a host that resolves to no IPv4 address is accepted regardless of where it points. Deployments that rely on the allowlist instead are unaffected, because there an unmatched address is rejected. This issue affects safeurl: from 0.1.0 onward.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-77866
EUVD
EUVD-2026-78678

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
slab safeurl From 0.1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-636 When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the Slab safeurl library. It allows an attacker who controls a validated URL to bypass network restrictions and access internal network destinations that the library is supposed to block. The issue occurs because the library only checks IPv4 addresses against reserved ranges and blocklists. IPv6 addresses, unmatched IPv4 addresses, or hosts resolving to no IPv4 address are incorrectly treated as safe and allowed.

Detection Guidance

To detect this SSRF vulnerability in safeurl, check if your system processes IPv6 addresses or unresolvable hosts without proper validation. Inspect network logs for outbound requests to internal IPs via IPv6 formats. Review safeurl configurations to ensure IPv6 and blocklist entries are enforced. Test by sending crafted URLs with IPv6 or unresolvable domains to see if they bypass restrictions.

Impact Analysis

An attacker could exploit this to access internal systems, services, or data that should be restricted. This could lead to unauthorized data exfiltration, internal network reconnaissance, or further attacks on internal infrastructure. Systems relying on safeurl's blocklist for security are particularly at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using safeurl may fail to meet data protection obligations, risking legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update safeurl to a version that fixes the IPv4/IPv6 mismatch issue. If using allowlist, verify it is properly configured to reject all unintended destinations. Test configurations to ensure IPv6 addresses are also blocked as intended.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77866. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart