CVE-2025-68616 is a high-severity vulnerability in Kozea WeasyPrint affecting versions before 68.0. The issue arises from the default_url_fetcher implementation, where the urllib library follows HTTP redirects automatically without re-checking the new destination against developer-defined SSRF protections. This behavior enables attackers to bypass SSRF restrictions and access internal network resources, including localhost and cloud metadata endpoints. The vulnerability is fixed in version 68.0. The Red Hat advisory confirms the vulnerability and the availability of a patch in the updated version.

Successful exploitation allows an unauthenticated attacker to bypass SSRF protections and access internal network resources that should be restricted, potentially exposing sensitive internal services or cloud metadata endpoints. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact.

Upgrade WeasyPrint to version 68.0 or later, where the vulnerability has been patched. The vendor advisory from Red Hat confirms that the issue is fixed in this version. No additional mitigation is required once the patch is applied.