CVE-2026-63088

Name of the Vulnerable Software and Affected Versions stoatchat versions prior to 0.14.0

Description An unauthenticated network-accessible attacker can perform a server-side request forgery (SSRF) by bypassing the DNS-based IP blocklist. This occurs due to incomplete address validation within the url is blacklisted() function, which only inspects the first resolved address, whereas the underlying HTTP client iterates through all cached addresses.

Recommendations Update to version 0.14.0 or later. As a temporary mitigation, restrict access to the url is blacklisted() function or the components utilizing it to minimize the risk of exploitation.