CVE-2026-77866 json
SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts
published 2026-09-15 54 d ago modified 2026-09-21 48 d ago also EEF-CVE-2026-77866 , EUVD-2026-78678
- cvss
- 9.0
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block.
Only IPv4 addresses are matched against the reserved ranges and the blocklist. Every other address is treated as matching nothing, so a destination that is rejected in its IPv4 form is accepted when written as an IPv6 address, IPv6 entries in the blocklist never match, and a host that resolves to no IPv4 address is accepted regardless of where it points. Deployments that rely on the allowlist instead are unaffected, because there an unmatched address is rejected.
This issue affects safeurl: from 0.1.0 onward.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 48 d ago
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.0 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N |
| CNA | 4.0 | 9.0 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| hex | safeurl | >=0.1.0 |
no fix listed |
Affected products
- Slab safeurl
Classification
References
-
github.com
/slab/safeurl-elixir/commit/feabbd0a13f83028ab24b71710526e9da9841f70
related, web
-
cna.erlef.org
/cves/CVE-2026-77866.html
related, third-party-advisory, web
-
osv.dev
/vulnerability/EEF-CVE-2026-77866
related
-
hex.pm
/packages/safeurl
package
Sources
- CVE List CVE-2026-77866
- NVD CVE-2026-77866
- OSV EEF-CVE-2026-77866
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.