CVE-2025-2691CWE-918

Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide a hostname that resolves to a…

High · published March 23, 2025

CVSS v4.0
8.8
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide a hostname that resolves to a local or reserved IP address space and bypass the SSRF protection mechanism.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00398 · 32.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-03-23T14:21Z
EPSS history
Timeline
  • 23 MAR 14:21Z
    Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide a hostname that resolves to a…
    cvelistv5