stoatchat versions before 0.14.0 suffer a server‑side request forgery flaw that allows attackers to subvert the DNS‑based IP blocklist. The vulnerability arises from incomplete address validation in the url_is_blacklisted routine, which only inspects the first resolved address. Because the underlying HTTP client follows all cached resolutions, an attacker can supply a URL that resolves to a blocked IP in the first lookup but includes subsequently cached addresses that reach internal or otherwise protected endpoints, thereby facilitating direct outbound requests from the vulnerable server.

All stoatchat installations running a version earlier than 0.14.0 are affected. The issue is present in the server component that processes arbitrary URLs supplied by users, and the product name is stoatchat from the vendor stoatchat.

The CVSS score of 7.7 classifies the flaw as high severity, and the EPSS score of < 1% indicates a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog. Attackers can exploit the issue from any publicly reachable endpoint that accepts user‑supplied URLs without requiring authentication. Successful exploitation does not require complex conditions; the attacker merely needs to craft a request containing a malicious URL that bypasses the blocklist via staged resolution and triggers the vulnerable HTTP client to contact the target internal resource.