The vulnerability in mealie-recipes mealie is due to a TOCTOU race condition in the AsyncSafeTransport SSRF guard implementation. The guard resolves the target hostname once to check if the IP is within private ranges, but the actual outbound HTTP request uses the original hostname which is re-resolved by the underlying async transport. This allows an attacker to potentially bypass the SSRF protection by exploiting the difference between the initial IP check and the actual IP used for the request.

An attacker may bypass the SSRF guard's IP address checks, potentially enabling server-side request forgery attacks that access internal or restricted network resources. The CVSS score of 5.3 (medium severity) reflects the network attack vector, high attack complexity, low privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about relying on the AsyncSafeTransport SSRF guard for protection against SSRF attacks and consider additional network-level controls or monitoring.