CVE-2025-2691 is a high-severity SSRF vulnerability in the nossrf package affecting all versions before 1.0.4. The vulnerability arises because the package's SSRF protection can be bypassed when an attacker provides a hostname that resolves to internal or reserved IP addresses. This enables the attacker to make unauthorized requests from the server to internal resources that should be protected. The CVSS 4.0 base score is 8.8, reflecting network attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality. There is no official remediation level or patch information currently available.

An attacker can exploit this vulnerability to make the server perform unauthorized requests to internal or reserved IP address spaces, potentially accessing sensitive internal services or data. This could lead to information disclosure or further internal network compromise depending on the environment and what internal resources are accessible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing additional network-level protections to restrict outbound requests from the affected application or environment. Monitor for updates from the vendor regarding an official patch or mitigation.