CVE-2026-63088

Published: Jul 16, 2026Modified: Jul 16, 2026Deferred

7.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated network-accessible attackers to bypass the DNS-based IP blocklist by exploiting incomplete address validation in the url_is_blacklisted function, which inspects only the first resolved address while the underlying HTTP client iterates all cached addresses.

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (5)

https://github.com/stoatchat/stoatchat/releases/tag/v0.14.0

Source: disclosure@vulncheck.com

https://github.com/stoatchat/stoatchat/security/advisories/GHSA-4mcc-p83c-r77q

Source: disclosure@vulncheck.com

https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/stoatchat-ssrf-via-dns-based-ip-blocklist-bypass

Source: disclosure@vulncheck.com

https://github.com/stoatchat/stoatchat/security/advisories/GHSA-4mcc-p83c-r77q

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.