PT-2025-31048

CVE-2025-8267

Published

2025-07-28

Updated

2026-05-05

Description by

CVSS 3.1

8.2

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions ssrfcheck versions prior to 1.2.0

Description The package is vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete denylist of IP address ranges. The package fails to classify the reserved IP address space 224.0.0.0/4 (Multicast) as invalid, allowing attackers to craft requests targeting these multicast addresses.

Recommendations Update to ssrfcheck version 1.2.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Liran Tal

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers