PT-2026-60519 · Stoatchat · Stoatchat

George Chen · CVE-2026-63088 · Publicado 2026-07-16 · Atualizado 2026-07-16

Mitre

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated network-accessible attackers to bypass the DNS-based IP blocklist by exploiting incomplete address validation in the url is blacklisted function, which inspects only the first resolved address while the underlying HTTP client iterates all cached addresses.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-63088

Produtos afetados

Stoatchat

Referências · 5

• 🔥 https://github.com/stoatchat/stoatchat/security/advisories/GHSA-4mcc-p83c-r77q · Exploit
• https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5 · Nota
• https://github.com/stoatchat/stoatchat/releases/tag/v0.14.0 · Correção
• https://vulncheck.com/advisories/stoatchat-ssrf-via-dns-based-ip-blocklist-bypass · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63088 · Nota de Segurança