High severity8.6NVD Advisory· Published Jul 16, 2026· Updated Jul 16, 2026

CVE-2026-63088

Description

stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated network-accessible attackers to bypass the DNS-based IP blocklist by exploiting incomplete address validation in the url_is_blacklisted function, which inspects only the first resolved address while the underlying HTTP client iterates all cached addresses.

Affected products

Stoatchat/stoatchatllm-fuzzy
Range: <0.14.0

Patches

Vulnerability mechanics

References

github.com/stoatchat/stoatchat/releases/tag/v0.14.0nvd
github.com/stoatchat/stoatchat/security/advisories/GHSA-4mcc-p83c-r77qnvd
github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5nvd
www.vulncheck.com/advisories/stoatchat-ssrf-via-dns-based-ip-blocklist-bypassnvd

News mentions

No linked articles in our index yet.

cvss	0.559
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000