CVE-2026-77866: SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts
Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block.
Only IPv4 addresses are matched against the reserved ranges and the blocklist. Every other address is treated as matching nothing, so a destination that is rejected in its IPv4 form is accepted when written as an IPv6 address, IPv6 entries in the blocklist never match, and a host that resolves to no IPv4 address is accepted regardless of where it points. Deployments that rely on the allowlist instead are unaffected, because there an unmatched address is rejected.
This issue affects safeurl: from 0.1.0 onward.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments using safeurl's blocklist or reserved-range protections are exposed. Deployments that rely on an allowlist are unaffected because addresses that do not match are rejected.
What does an attacker need to exploit the issue?
The attacker must be able to control a URL that passes validation and causes the application to make a request. They can use an IPv6 representation of a blocked destination or a host with no IPv4 resolution to bypass IPv4-only matching.
Are IPv6 addresses covered by the configured blocklist?
No. Only IPv4 addresses are matched against reserved ranges and the blocklist, so IPv6 blocklist entries do not match.
How can I determine whether my application is affected?
Check whether the application uses safeurl version 0.1.0 or later and relies on blocklist or reserved-range validation for SSRF protection. Test whether a normally rejected internal IPv4 destination is accepted when represented as IPv6, or whether a hostname without an IPv4 address is accepted.