https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 15:43:12 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-226328 EUVD-2026-226328 https://cve.radiocsirt.org/vuln/euvd-2026-226328 https://cve.radiocsirt.org/vuln/fkie_cve-2025-31116 <p>Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF abuse using DNS rebinding technique. This vulnerability is fixed in 4.3.2.</p> <p>Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF abuse using DNS rebinding technique. This vulnerability is fixed in 4.3.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-31116 https://cve.radiocsirt.org/vuln/ghsa-fcfq-m8p6-gw56 <p><strong>Affected:</strong> PyPI: mobsf</p> <p>### Summary</p> <p>The latest deployed fix for the SSRF vulnerability is through the use of the call `valid_host()`. The code available at lines [/ae34f7c055aa64fca58e995b70bc7f19da6ca33a/mobsf/MobSF/utils.py#L907-L957](https://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/ae34f7c055aa64fca58e995b70bc7f19da6ca33a/mobsf/MobSF/utils.py#L907-L957) is vulnerable to SSRF abuse using DNS rebinding technique.</p> <p>### PoC</p> <p>The following proof of concept:</p> <p>```python def valid_host(host): &#34;&#34;&#34;Check if host is valid.&#34;&#34;&#34; try: prefixs = (&#39;http://&#39;, &#39;https://&#39;) if not host.startswith(prefixs): host = f&#39;http://{host}&#39; parsed = urlparse(host) domain = parsed.netloc path = parsed.path if len(domain) == 0: # No valid domain return False, None if len(path) &gt; 0: # Only host is allowed return False, None if &#39;:&#39; in domain: # IPv6 return False, None # Local network invalid_prefix = ( &#39;100.64.&#39;, &#39;127.&#39;, &#39;192.&#39;, &#39;198.&#39;, &#39;10.&#39;, &#39;172.&#39;, &#39;169.&#39;, &#39;0.&#39;, &#39;203.0.&#39;, &#39;224.0.&#39;, &#39;240.0&#39;, &#39;255.255.&#39;, &#39;localhost&#39;, &#39;::1&#39;, &#39;64::ff9b::&#39;, &#39;100::&#39;, &#39;2001::&#39;, &#39;2002::&#39;, &#39;fc00::&#39;, &#39;fe80::&#39;, &#39;ff00::&#39;)…</p> <p><strong>Affected:</strong> PyPI: mobsf</p> <p>### Summary</p> <p>The latest deployed fix for the SSRF vulnerability is through the use of the call `valid_host()`. The code available at lines [/ae34f7c055aa64fca58e995b70bc7f19da6ca33a/mobsf/MobSF/utils.py#L907-L957](https://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/ae34f7c055aa64fca58e995b70bc7f19da6ca33a/mobsf/MobSF/utils.py#L907-L957) is vulnerable to SSRF abuse using DNS rebinding technique.</p> <p>### PoC</p> <p>The following proof of concept:</p> <p>```python def valid_host(host): &#34;&#34;&#34;Check if host is valid.&#34;&#34;&#34; try: prefixs = (&#39;http://&#39;, &#39;https://&#39;) if not host.startswith(prefixs): host = f&#39;http://{host}&#39; parsed = urlparse(host) domain = parsed.netloc path = parsed.path if len(domain) == 0: # No valid domain return False, None if len(path) &gt; 0: # Only host is allowed return False, None if &#39;:&#39; in domain: # IPv6 return False, None # Local network invalid_prefix = ( &#39;100.64.&#39;, &#39;127.&#39;, &#39;192.&#39;, &#39;198.&#39;, &#39;10.&#39;, &#39;172.&#39;, &#39;169.&#39;, &#39;0.&#39;, &#39;203.0.&#39;, &#39;224.0.&#39;, &#39;240.0&#39;, &#39;255.255.&#39;, &#39;localhost&#39;, &#39;::1&#39;, &#39;64::ff9b::&#39;, &#39;100::&#39;, &#39;2001::&#39;, &#39;2002::&#39;, &#39;fc00::&#39;, &#39;fe80::&#39;, &#39;ff00::&#39;)…</p> https://cve.radiocsirt.org/vuln/ghsa-fcfq-m8p6-gw56 https://cve.radiocsirt.org/vuln/pysec-2025-48 <p><strong>Affected:</strong> PyPI: mobsf</p> <p>Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF abuse using DNS rebinding technique. This vulnerability is fixed in 4.3.2.</p> <p><strong>Affected:</strong> PyPI: mobsf</p> <p>Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF abuse using DNS rebinding technique. This vulnerability is fixed in 4.3.2.</p> https://cve.radiocsirt.org/vuln/pysec-2025-48