CVE-2025-2691: Nossrf Project Nossrf

Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide a hostname that resolves to a local or reserved IP address space and bypass the SSRF protection mechanism.

Affected products

Published 2025-03-23. Last modified 2026-06-17.