{"id":"CVE-2025-24354","aliases":["GHSA-j2hp-6m75-v4j4","GO-2025-3422"],"url":"https://o3.security/vulnerability/CVE-2025-24354","summary":"imgproxy is vulnerable to SSRF against 0.0.0.0","details":"### Summary\n\nImgproxy does not block the `0.0.0.0` address, even with `IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES` set to false. This can expose services on the local host.\n\n### Details\n\nimgproxy protects against SSRF against a loopback address with the following check ([source](https://github.com/imgproxy/imgproxy/blob/0f37d62fd8326a32c213b30dd52e2319770885d8/security/source.go#L43C1-L47C1)):\n\n```\nif !config.AllowLoopbackSourceAddresses && ip.IsLoopback() {\n\treturn ErrSourceAddressNotAllowed\n}\n```\n\nThis check is insufficient to prevent accessing services on the local host, as services may receive traffic on `0.0.0.0`. Go's `IsLoopback` ([source](https://github.com/golang/go/blob/40b3c0e58a0ae8dec4684a009bf3806769e0fc41/src/net/ip.go#L126-L131)) strictly follows the definition of loopback IPs beginning with `127`. `0.0.0.0` is not blocked.","published":"2025-01-27T17:23:58.303Z","modified":"2026-08-12T03:51:25.905687219Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/imgproxy/imgproxy","fixedVersion":"3.27.2"}],"fix":{"url":"https://github.com/imgproxy/imgproxy/commit/3d4fed6842aa8930ec224d0ad75b0079b858e081","label":"imgproxy/imgproxy@3d4fed6"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24354.json"},{"type":"ADVISORY","url":"https://github.com/imgproxy/imgproxy/security/advisories/GHSA-j2hp-6m75-v4j4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24354"},{"type":"FIX","url":"https://github.com/imgproxy/imgproxy/commit/3d4fed6842aa8930ec224d0ad75b0079b858e081"},{"type":"PACKAGE","url":"https://github.com/imgproxy/imgproxy"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:25.905687219Z"}}