Race Condition Vulnerability in Slab Safeurl Product

CVE-2026-77972

What is CVE-2026-77972?

A race condition issue in the Slab Safeurl library enables an attacker controlling DNS responses to bypass intended validation mechanisms. The situation arises when initial hostname resolutions can provide an approved address, but subsequent lookups can shift to a blocked address. This introduces critical points where an attacker can redirect requests to internal network destinations that were supposed to be blocked, exploiting the timing differences in DNS resolution. This vulnerability has implications for both external attackers and legitimate hostname configurations that may switch addresses frequently.

References