{"id":3760749,"name":"safeurl","ecosystem":"hex","description":"SSRF Protection in Elixir 🛡️","homepage":"https://slab.com/","licenses":"BSD-3-Clause","normalized_licenses":["BSD-3-Clause"],"repository_url":"https://github.com/slab/safeurl-elixir","keywords_array":[],"namespace":null,"versions_count":5,"first_release_published_at":"2022-02-01T02:57:51.770Z","latest_release_published_at":"2025-01-15T18:21:08.511Z","latest_release_number":"1.0.0","last_synced_at":"2026-10-07T18:27:27.705Z","created_at":"2022-04-11T15:54:11.070Z","updated_at":"2026-10-08T10:29:51.094Z","registry_url":"https://hex.pm/packages/safeurl/","install_command":"mix hex.package fetch safeurl","documentation_url":"http://hexdocs.pm/safeurl/","metadata":{},"repo_metadata":{"id":40347442,"uuid":"346107864","full_name":"slab/safeurl-elixir","owner":"slab","description":"HTTP client with built-in SSRF protection, compatible with Tesla and HTTPoison","archived":false,"fork":false,"pushed_at":"2025-01-15T18:23:18.000Z","size":42,"stargazers_count":73,"open_issues_count":2,"forks_count":3,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-09-16T21:16:31.202Z","etag":null,"topics":["allowlist","anti-ssrf","appsec","blacklist","blocklist","cidr-ranges","defensivetool","elixir","hacking","safeurl","ssrf","web","webhacking","websecurity","whitelist"],"latest_commit_sha":null,"homepage":"","language":"Elixir","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/slab.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-03-09T18:39:54.000Z","updated_at":"2026-08-20T07:10:10.000Z","dependencies_parsed_at":"2024-06-03T18:23:35.615Z","dependency_job_id":"985d8c0f-655c-4005-ab9c-cc700c045997","html_url":"https://github.com/slab/safeurl-elixir","commit_stats":{"total_commits":23,"total_committers":5,"mean_commits":4.6,"dds":"0.34782608695652173","last_synced_commit":"7b1a15d60b886870d08a297469794b0530899c12"},"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/slab/safeurl-elixir","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/slab%2Fsafeurl-elixir","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/slab%2Fsafeurl-elixir/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/slab%2Fsafeurl-elixir/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/slab%2Fsafeurl-elixir/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/slab","download_url":"https://codeload.github.com/slab/safeurl-elixir/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/slab%2Fsafeurl-elixir/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":341189360,"owners_count":37509739,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-09-19T02:00:07.094Z","response_time":73,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"slab","name":"Slab","uuid":"22188121","kind":"organization","description":"Making the workplace a source of learning and purpose through knowledge-sharing. We're hiring!","email":"hello@slab.com","website":"https://slab.com/careers","location":"United States of America","twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/22188121?v=4","repositories_count":18,"last_synced_at":"2026-10-06T13:25:07.595Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/slab","funding_links":[],"total_stars":49599,"followers":125,"following":0,"created_at":"2022-11-17T12:48:51.497Z","updated_at":"2026-10-06T13:25:07.608Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/slab","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/slab/repositories"},"tags":[{"name":"v0.3.1","sha":"c2bb2e585a951984474144154b611fef1315d553","kind":"commit","published_at":"2024-06-03T18:28:36.000Z","download_url":"https://codeload.github.com/slab/safeurl-elixir/tar.gz/v0.3.1","html_url":"https://github.com/slab/safeurl-elixir/releases/tag/v0.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/slab/safeurl-elixir@v0.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/slab%2Fsafeurl-elixir/tags/v0.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/slab%2Fsafeurl-elixir/tags/v0.3.1/manifests"},{"name":"v0.3.0","sha":"0318e740c3bad33fc49e35e879c3878994a4e5e7","kind":"commit","published_at":"2022-05-13T21:59:56.000Z","download_url":"https://codeload.github.com/slab/safeurl-elixir/tar.gz/v0.3.0","html_url":"https://github.com/slab/safeurl-elixir/releases/tag/v0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/slab/safeurl-elixir@v0.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/slab%2Fsafeurl-elixir/tags/v0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/slab%2Fsafeurl-elixir/tags/v0.3.0/manifests"},{"name":"v0.2.0","sha":"bc9f1ed421d4e3a6b6ee47ccd333e1f0728b13c3","kind":"commit","published_at":"2022-02-13T02:16:57.000Z","download_url":"https://codeload.github.com/slab/safeurl-elixir/tar.gz/v0.2.0","html_url":"https://github.com/slab/safeurl-elixir/releases/tag/v0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/slab/safeurl-elixir@v0.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/slab%2Fsafeurl-elixir/tags/v0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/slab%2Fsafeurl-elixir/tags/v0.2.0/manifests"},{"name":"v0.1.0","sha":"ac087d6a1385e73151bfbf301b38e492d1022fce","kind":"commit","published_at":"2022-02-01T02:56:21.000Z","download_url":"https://codeload.github.com/slab/safeurl-elixir/tar.gz/v0.1.0","html_url":"https://github.com/slab/safeurl-elixir/releases/tag/v0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/slab/safeurl-elixir@v0.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/slab%2Fsafeurl-elixir/tags/v0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/slab%2Fsafeurl-elixir/tags/v0.1.0/manifests"}]},"repo_metadata_updated_at":"2026-10-07T18:28:53.891Z","dependent_packages_count":0,"downloads":107371,"downloads_period":"total","dependent_repos_count":0,"rankings":{"downloads":29.231311706629054,"dependent_repos_count":34.46403385049365,"dependent_packages_count":21.417489421720735,"stargazers_count":12.150916784203103,"forks_count":32.73624823695346,"average":26.0},"purl":"pkg:hex/safeurl","advisories":[{"uuid":"EEF-CVE-2026-77866","url":"https://cna.erlef.org/cves/CVE-2026-77866.html","title":"SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts","description":"## Summary\n\nServer-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block.\n\nOnly IPv4 addresses are matched against the reserved ranges and the blocklist. Every other address is treated as matching nothing, so a destination that is rejected in its IPv4 form is accepted when written as an IPv6 address, IPv6 entries in the blocklist never match, and a host that resolves to no IPv4 address is accepted regardless of where it points. Deployments that rely on the allowlist instead are unaffected, because there an unmatched address is rejected.\n\nThis issue affects safeurl: from 0.1.0 onward.","origin":"ERLEF","severity":"CRITICAL","published_at":"2026-09-15T15:38:15.886Z","withdrawn_at":null,"classification":null,"cvss_score":9.0,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","references":["https://cna.erlef.org/cves/CVE-2026-77866.html","https://github.com/slab/safeurl-elixir/commit/feabbd0a13f83028ab24b71710526e9da9841f70","https://hex.pm/packages/safeurl"],"source_kind":"erlef","identifiers":["EEF-CVE-2026-77866","CVE-2026-77866"],"repository_url":"https://github.com/slab/safeurl-elixir","blast_radius":1.0,"created_at":"2026-09-15T16:31:48.392Z","updated_at":"2026-09-15T15:38:16.449Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/EEF-CVE-2026-77866","html_url":"https://advisories.ecosyste.ms/advisories/EEF-CVE-2026-77866","packages":[{"ecosystem":"hex","package_name":"safeurl","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003e= 0.1.0"}],"purl":null,"statistics":{"dependent_packages_count":0,"dependent_repos_count":0,"downloads":107371,"downloads_period":"total"},"affected_versions":["0.1.0","0.2.0","0.3.0","0.3.1","1.0.0"],"unaffected_versions":[]}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/EEF-CVE-2026-77866/related_packages","related_advisories":[]},{"uuid":"EEF-CVE-2026-77972","url":"https://cna.erlef.org/cves/CVE-2026-77972.html","title":"safeurl validated address is not bound to the request, allowing DNS rebinding","description":"## Summary\n\nTime-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected.\n\nValidation returns a verdict and not the address it approved, so the HTTP clients the library ships receive the original hostname and resolve it a second time when the request is made. An attacker who controls the authoritative DNS for a name can answer the first lookup with a permitted address and the second with a blocked one, and the request then reaches a destination validation never approved. The same window opens without an attacker whenever a name legitimately resolves to different addresses across lookups, such as short record lifetimes or rotation between several addresses.\n\nThis issue affects safeurl: from 0.1.0 onward.","origin":"ERLEF","severity":"CRITICAL","published_at":"2026-09-15T15:37:49.948Z","withdrawn_at":null,"classification":null,"cvss_score":9.0,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","references":["https://cna.erlef.org/cves/CVE-2026-77972.html","https://github.com/slab/safeurl-elixir/commit/feabbd0a13f83028ab24b71710526e9da9841f70","https://hex.pm/packages/safeurl"],"source_kind":"erlef","identifiers":["EEF-CVE-2026-77972","CVE-2026-77972"],"repository_url":"https://github.com/slab/safeurl-elixir","blast_radius":1.0,"created_at":"2026-09-15T16:31:48.687Z","updated_at":"2026-09-15T15:37:50.506Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/EEF-CVE-2026-77972","html_url":"https://advisories.ecosyste.ms/advisories/EEF-CVE-2026-77972","packages":[{"ecosystem":"hex","package_name":"safeurl","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003e= 0.1.0"}],"purl":null,"statistics":{"dependent_packages_count":0,"dependent_repos_count":0,"downloads":107371,"downloads_period":"total"},"affected_versions":["0.1.0","0.2.0","0.3.0","0.3.1","1.0.0"],"unaffected_versions":[]}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/EEF-CVE-2026-77972/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/hex/safeurl","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/hex/safeurl","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/hex/safeurl/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-10-07T18:28:23.867Z","issues_count":6,"pull_requests_count":15,"avg_time_to_close_issue":17348547.25,"avg_time_to_close_pull_request":411761.6666666667,"issues_closed_count":4,"pull_requests_closed_count":12,"pull_request_authors_count":4,"issue_authors_count":6,"avg_comments_per_issue":0.3333333333333333,"avg_comments_per_pull_request":0.6,"merged_pull_requests_count":12,"bot_issues_count":0,"bot_pull_requests_count":0,"past_year_issues_count":0,"past_year_pull_requests_count":1,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":null,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":0,"past_year_pull_request_authors_count":1,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":1.0,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":0,"past_year_merged_pull_requests_count":0,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/slab%2Fsafeurl-elixir/issues","maintainers":[{"login":"martosaur","count":10,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/martosaur"}],"active_maintainers":[]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/hex.pm/packages/safeurl/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/hex.pm/packages/safeurl/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/hex.pm/packages/safeurl/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/hex.pm/packages/safeurl/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/hex.pm/packages/safeurl/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/hex.pm/packages/safeurl/codemeta","maintainers":[{"uuid":"slab","login":"slab","name":null,"email":"support@slab.com","url":null,"packages_count":4,"html_url":"https://hex.pm/users/slab","role":null,"created_at":"2022-11-08T14:12:41.024Z","updated_at":"2022-11-08T14:12:41.024Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/hex.pm/maintainers/slab/packages"}]}