Executive brief
Slab safeurl is a library that validates whether HTTP requests are allowed to reach specific network destinations. A time-of-check time-of-use (TOCTOU) race condition allows an attacker who controls a domain's DNS responses to bypass validation and reach internal network addresses that should be blocked. An attacker can respond with a permitted address during validation but a blocked address during the actual request, causing the library to permit access to prohibited destinations.
Technical details
The vulnerability is a TOCTOU race condition in DNS hostname resolution and validation. The library validates a hostname and returns only a verdict (allowed/denied), not the resolved IP address; HTTP clients then resolve the hostname again at request time. An attacker controlling authoritative DNS for a domain can answer the first lookup with a permitted address and the second with a blocked internal address, bypassing validation. The same vulnerability window exists non-maliciously when hostnames legitimately resolve to different addresses between lookups (short TTLs or round-robin DNS). The issue affects safeurl from version 0.1.0 onward, with no patch status indicated in available advisories.
Affected products
- Slab safeurl 0.1.0 and later
Timeline
- 2026-09-15: disclosed