CVE-2026-77972

Slab's safeurl Ruby library, which guards against server-side request forgery (SSRF), suffers a time-of-check to time-of-use (TOCTOU) race condition affecting all versions from 0.1.0 onward. Validation resolves a hostname and checks the resulting address, but returns only a pass/fail verdict — the HTTP clients shipped with the library receive the original hostname and resolve it a second time when the request is actually made. An attacker who controls the authoritative DNS for a requested name can answer the first lookup with a permitted address and the second with a blocked one, causing the request to reach internal network destinations that validation explicitly rejected. The same bypass can occur without an attacker whenever a name legitimately resolves to different addresses across lookups (short DNS TTLs or multi-address rotation). No fixed version is identified in the available data, and no public proof-of-concept or in-the-wild exploitation is known.

What to do: Inventory your Ruby dependency trees for the safeurl gem and treat any version from 0.1.0 onward as affected; watch for a patched release from Slab and upgrade immediately when one ships. Until then, mitigate by resolving the hostname once, using the validated IP for the actual request (DNS pinning) rather than re-resolving the hostname, or routing outbound fetches through an egress proxy that enforces destination checks at connection time. Review application logs for requests where the destination address differed from the validated one, and confirm that internal services require authentication rather than relying on network reachability alone.