CVE-2026-77972: safeurl DNS Rebinding Vulnerability Allows Internal Network Access
Summary
CVE-2026-77972: safeurl validated address is not bound to the request, allowing DNS rebinding. Affects safeurl across 2 version ranges.
>= 0.1.0
>= feabbd0a13f83028ab24b71710526e9da9841f70
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
safeurl is a library designed for validating URLs in Elixir applications, ensuring that only safe and permitted addresses are used in HTTP requests. It provides developers with a means to prevent malicious URL manipulations and enhance the security of their applications. However, a recent vulnerability has been identified that exposes safeurl to DNS rebinding attacks, allowing unauthorized access to internal network resources.
Vulnerability Detail
The vulnerability arises from a Time-of-check Time-of-use (TOCTOU) race condition in the safeurl library. When a hostname is validated, the library does not bind the validated address to the request. Instead, it allows the HTTP clients to resolve the original hostname again when making the request. An attacker controlling the DNS responses can exploit this by providing a valid address during the first lookup and a blocked address during the second, leading to unauthorized access to internal network destinations that were initially rejected by validation. This issue affects safeurl versions from 0.1.0 onward and poses significant risks, especially in environments where sensitive internal services are accessible.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing additional network security measures such as firewall rules to restrict access to internal services based on hostname resolution. Additionally, avoid using dynamic DNS for internal services that are validated by safeurl.
Conclusion
The CVE-2026-77972 vulnerability in the safeurl library poses a significant risk due to its potential for DNS rebinding attacks. It is crucial for developers using this library to update to the latest patched version and implement additional security measures to protect internal network resources.
See every vulnerability recorded for safeurl →
FAQ
CVE-2026-77972 is a vulnerability in the safeurl library that allows attackers to exploit DNS rebinding to access internal network resources.
The attack works by manipulating DNS responses to provide a valid address during the first lookup and a blocked address during the second, allowing unauthorized access.
All versions of safeurl from 0.1.0 onward are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 9.0, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for safeurl.
