CVE-2026-77972: safeurl validated address is not bound to the request, allowing DNS rebinding
Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected.
Validation returns a verdict and not the address it approved, so the HTTP clients the library ships receive the original hostname and resolve it a second time when the request is made. An attacker who controls the authoritative DNS for a name can answer the first lookup with a permitted address and the second with a blocked one, and the request then reaches a destination validation never approved. The same window opens without an attacker whenever a name legitimately resolves to different addresses across lookups, such as short record lifetimes or rotation between several addresses.
This issue affects safeurl: from 0.1.0 onward.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
safeurlto a version that resolves this vulnerability.Fixed in 0.1.0 - Compensating control
Mitigate DNS rebinding/TOCTOU by ensuring hostnames resolved by safeurl cannot change IPs between the safeurl validation lookup and the actual HTTP request (e.g., disable or restrict DNS responses for authoritative domains you do not trust; ensure clients use only DNS that cannot be controlled by an attacker).
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using safeurl version 0.1.0 or later are affected when they make requests to hostnames whose DNS answers can change between validation and connection. The highest-risk case is an attacker-controlled hostname with attacker-controlled authoritative DNS responses.
What does an attacker need to exploit the issue?
The attacker needs control of DNS responses for a hostname. They must cause the hostname to resolve to a permitted address during safeurl validation and to a blocked internal address when the HTTP client resolves the hostname again for the request.
Can this occur without an attacker controlling DNS?
Yes. A hostname that legitimately returns different addresses on separate lookups, such as through short DNS record lifetimes or address rotation, can create the same validation-to-request mismatch.
How can I determine whether a request may be affected?
Review uses of safeurl where validation is followed by an HTTP request using the original hostname. Those requests are vulnerable to a changed DNS result because the validation verdict is not bound to the address used by the HTTP client.