eef-cve-2026-77972

{
  "affected": [
    {
      "database_specific": {
        "source": "https://cna.erlef.org/osv/EEF-CVE-2026-77972.json"
      },
      "package": {
        "ecosystem": "Hex",
        "name": "safeurl",
        "purl": "pkg:hex/safeurl"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": [
        "0.1.0",
        "0.2.0",
        "0.3.0",
        "0.3.1",
        "1.0.0"
      ]
    },
    {
      "database_specific": {
        "source": "https://cna.erlef.org/osv/EEF-CVE-2026-77972.json"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "feabbd0a13f83028ab24b71710526e9da9841f70"
            }
          ],
          "repo": "https://github.com/slab/safeurl-elixir",
          "type": "GIT"
        }
      ],
      "versions": [
        "v1.0.0",
        "v0.3.1",
        "v0.3.0",
        "v0.2.0",
        "v0.1.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77972"
  ],
  "credits": [
    {
      "name": "Jonatan Männchen / EEF",
      "type": "REPORTER"
    },
    {
      "name": "Jonatan Männchen / EEF",
      "type": "COORDINATOR"
    }
  ],
  "database_specific": {
    "capec_ids": [
      "CAPEC-664"
    ],
    "cpe_ids": [
      "cpe:2.3:a:slab:safeurl:*:*:*:*:*:*:*:*"
    ],
    "cwe_ids": [
      "CWE-367"
    ]
  },
  "details": "## Summary\n\nTime-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected.\n\nValidation returns a verdict and not the address it approved, so the HTTP clients the library ships receive the original hostname and resolve it a second time when the request is made. An attacker who controls the authoritative DNS for a name can answer the first lookup with a permitted address and the second with a blocked one, and the request then reaches a destination validation never approved. The same window opens without an attacker whenever a name legitimately resolves to different addresses across lookups, such as short record lifetimes or rotation between several addresses.\n\nThis issue affects safeurl: from 0.1.0 onward.",
  "id": "EEF-CVE-2026-77972",
  "modified": "2026-09-15T15:45:03.321931831Z",
  "published": "2026-09-15T15:37:49.948Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-77972.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/slab/safeurl-elixir/commit/feabbd0a13f83028ab24b71710526e9da9841f70"
    },
    {
      "type": "PACKAGE",
      "url": "https://hex.pm/packages/safeurl"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "safeurl validated address is not bound to the request, allowing DNS rebinding"
}