CVE-2026-77972
Received Received - Intake

Time-of-check Time-of-use Race Condition in Slab safeurl

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: EEF

Description
Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected. Validation returns a verdict and not the address it approved, so the HTTP clients the library ships receive the original hostname and resolve it a second time when the request is made. An attacker who controls the authoritative DNS for a name can answer the first lookup with a permitted address and the second with a blocked one, and the request then reaches a destination validation never approved. The same window opens without an attacker whenever a name legitimately resolves to different addresses across lookups, such as short record lifetimes or rotation between several addresses. This issue affects safeurl: from 0.1.0 onward.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-77972
EUVD
EUVD-2026-78676

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
safeurl safeurl From 0.1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Time-of-check Time-of-use (TOCTOU) race condition in the Slab safeurl library. It allows an attacker who controls DNS responses for a hostname to bypass address validation and reach internal network destinations that should have been blocked. The library validates a hostname but returns the original hostname to HTTP clients instead of the approved address. The client then resolves the hostname again, and an attacker can manipulate DNS responses to change the resolved address between validation and request execution.

Detection Guidance

To detect this TOCTOU race condition in safeurl, monitor DNS resolution behavior for applications using the library. Check if hostname resolutions change between validation and request phases. Inspect logs for repeated DNS lookups for the same hostname within short timeframes. Test with DNS records that have short TTL values or rapid address rotations.

Impact Analysis

This vulnerability could allow unauthorized access to internal systems or sensitive resources if an attacker controls DNS responses for a hostname you use. It may lead to data breaches, unauthorized data access, or lateral movement within a network. The impact depends on the network configuration and the permissions of the targeted services.

Compliance Impact

This vulnerability could lead to unauthorized access to internal network resources, potentially exposing sensitive data. For GDPR, this may result in violations of data protection principles if personal data is accessed without authorization. For HIPAA, it could allow unauthorized access to protected health information, violating compliance requirements.

Mitigation Strategies

Upgrade safeurl to a version that addresses the TOCTOU race condition. Avoid using safeurl versions from 0.1.0 onward until patched. Review DNS resolution behavior for hostnames to detect inconsistent address responses across lookups.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77972. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart