Is CVE-2026-77972 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77972 being exploited in the wild.

How severe is CVE-2026-77972?

Informational severity, published 15 September 2026.

Is there a fix for CVE-2026-77972?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-77972 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-77972?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77972: Slab safeurl TOCTOU race condition in DNS validation

CVE-2026-77972 · Severity: info · Published 2026-09-15

Slab safeurl is a library that validates whether HTTP requests are allowed to reach specific network destinations. A time-of-check time-of-use (TOCTOU) race condition allows an attacker who controls a domain's DNS responses to bypass validation and reach internal network addresses that should be blocked. An attacker can respond with a permitted address during validation but a blocked address during the actual request, causing the library to permit access to prohibited destinations.

Quick answers

Is CVE-2026-77972 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77972 being exploited in the wild.
How severe is CVE-2026-77972?: Informational severity, published 15 September 2026.
Which products and versions are affected?: Slab safeurl 0.1.0 and later.
Is there a fix for CVE-2026-77972?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-77972 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-77972?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a TOCTOU race condition in DNS hostname resolution and validation. The library validates a hostname and returns only a verdict (allowed/denied), not the resolved IP address; HTTP clients then resolve the hostname again at request time. An attacker controlling authoritative DNS for a domain can answer the first lookup with a permitted address and the second with a blocked internal address, bypassing validation. The same vulnerability window exists non-maliciously when hostnames legitimately resolve to different addresses between lookups (short TTLs or round-robin DNS). The issue affects safeurl from version 0.1.0 onward, with no patch status indicated in available advisories.

Affected products

Slab safeurl 0.1.0 and later

Timeline

2026-09-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.