CVE-2025-2691 describes an SSRF vulnerability in the nossrf package prior to version 1.0.4. The flaw allows attackers to bypass SSRF protections by providing hostnames that resolve to local or reserved IP addresses, potentially enabling unauthorized internal network access. The vulnerability has a CVSS 4.0 base score of 8.8, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality. No vendor advisory or patch information is currently provided, and the package is not a cloud service.

An attacker can exploit this SSRF vulnerability to make the server perform unauthorized requests to internal or reserved IP address spaces, potentially exposing sensitive internal resources or services. The high CVSS score reflects significant confidentiality impact and ease of exploitation without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor vendor communications for updates. Until a fix is available, consider implementing external network controls or additional SSRF protections at the application or network level to limit internal request capabilities.