PT-2026-60519 · Stoatchat · Stoatchat

George Chen · CVE-2026-63088 · Published 2026-07-16 · Updated 2026-07-16

Mitre

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated network-accessible attackers to bypass the DNS-based IP blocklist by exploiting incomplete address validation in the url is blacklisted function, which inspects only the first resolved address while the underlying HTTP client iterates all cached addresses.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-63088

Affected Products

Stoatchat

References · 5

• 🔥 https://github.com/stoatchat/stoatchat/security/advisories/GHSA-4mcc-p83c-r77q · Exploit
• https://github.com/stoatchat/stoatchat/releases/tag/v0.14.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-63088 · Security Note
• https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5 · Note
• https://vulncheck.com/advisories/stoatchat-ssrf-via-dns-based-ip-blocklist-bypass · Note