CVE-2025-57814

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-57814

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57814.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-57814

Aliases

GHSA-pw25-c82r-75mm

Published

2025-08-25T21:48:09.780Z

Modified

2026-04-10T05:32:42.082169Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P CVSS Calculator

Summary

request-filtering-agent SSRF Bypass via HTTPS Requests

Details

request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Versions 1.x.x and earlier contain a vulnerability where HTTPS requests to 127.0.0.1 bypass IP address filtering, while HTTP requests are correctly blocked. This allows attackers to potentially access internal HTTPS services running on localhost, bypassing the library's SSRF protection. The vulnerability is particularly dangerous when the application accepts user-controlled URLs and internal services are only protected by network-level restrictions. This vulnerability has been fixed in request-filtering-agent version 2.0.0. Users should upgrade to version 2.0.0 or later.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57814.json"
}

References

Affected packages

Git / github.com/azu/request-filtering-agent

Affected ranges

Type

GIT

Repo

https://github.com/azu/request-filtering-agent

Events

Introduced

Fixed

6e8455e6b229a9ba74f5d9f25ebd3b7b3e722a53

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.0"
        }
    ]
}

Affected versions

1.*

1.0.1

1.0.2

1.0.3

1.0.4

v1.*

v1.0.5

v1.0.6

v1.0.7

v1.1.0

v1.1.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57814.json"