CVE-2025-8020 affects all versions of the private-ip package, specifically version 0 as stated. The vulnerability is a Server-Side Request Forgery (SSRF) where the package's source code fails to include multicast IP addresses (224.0.0.0/4) in its private IP range checks. This omission allows an attacker to provide an IP or hostname resolving to a multicast address, potentially causing the server to make unintended network requests. The CVSS 4.0 score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

An attacker can exploit this SSRF vulnerability to induce the server to make network requests to multicast IP addresses, which are not properly filtered by the private-ip package. This could lead to unauthorized network interactions or information disclosure depending on the server environment and network configuration. No known exploits in the wild have been reported as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the vendor's announcements for updates and consider implementing network-level controls to restrict outbound requests to untrusted IP ranges as a temporary mitigation.