Server-Side Request Forgery Vulnerability in Slab Safeurl

CVE-2026-77866

What is CVE-2026-77866?

The Slab Safeurl library is vulnerable to a Server-Side Request Forgery (SSRF) attack, permitting an attacker with a validated URL to bypass configurations that should block access to internal network resources. This vulnerability arises because only IPv4 addresses are evaluated against reserved ranges and a blocklist. IPv6 addresses are excluded from this matching process, leading to potential exposure of services that would typically be protected. This issue affects all versions of Safeurl from 0.1.0 onwards, except for those employing an allowlist configuration where unmatched addresses are appropriately rejected. It highlights the importance of reviewing network configurations and ensuring comprehensive address filtering.

References