CVE-2026-63088: stoatchat < 0.14.0 SSRF via DNS-based IP Blocklist Bypass
stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated network-accessible attackers to bypass the DNS-based IP blocklist by exploiting incomplete address validation in the urlisblacklisted function, which inspects only the first resolved address while the underlying HTTP client iterates all cached addresses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
stoatchatto a version that resolves this vulnerability.Fixed in 0.14.0 - Compensating control
Ensure network egress filtering blocks SSRF targets (e.g., restrict outbound connections from the stoatchat server to only required destinations) to reduce impact while addressing the stoatchat <0.14.0 SSRF issue.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63088?
CVE-2026-63088 has a severity score of 8.6, indicating a high risk.
What type of vulnerability is CVE-2026-63088?
CVE-2026-63088 is classified as a server-side request forgery (SSRF) vulnerability.
How do I fix CVE-2026-63088?
To fix CVE-2026-63088, upgrade stoatchat to version 0.14.0 or later.
Who can exploit CVE-2026-63088?
CVE-2026-63088 can be exploited by unauthenticated network-accessible attackers.
What impact does CVE-2026-63088 have?
CVE-2026-63088 allows attackers to bypass DNS-based IP blocklists, potentially leading to unauthorized access.