CVE-2025-31116: Opensecurity Mobile Security Framework

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF abuse using DNS rebinding technique. This vulnerability is fixed in 4.3.2.

Affected products

• Opensecurity Mobile Security Framework: before 4.3.2 (fixed in 4.3.2)

Published 2025-03-31. Last modified 2026-06-17.