PT-2025-34712 · Pypi · Request-Filtering-Agent

Ikkisoft · Published 2025-08-25 · Updated 2025-08-26 · CVE-2025-57814

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: request-filtering-agent versions 1.x.x and earlier

Description: request-filtering-agent is an http(s).Agent implementation designed to block requests to Private/Reserved IP addresses. HTTPS requests to 127.0.0.1 bypass IP address filtering, while HTTP requests are correctly blocked. This allows potential access to internal HTTPS services running on localhost, bypassing the library’s Server-Side Request Forgery (SSRF) protection. The issue is particularly dangerous when applications accept user-controlled URLs and internal services are protected only by network-level restrictions.

Recommendations: Upgrade to request-filtering-agent version 2.0.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-57814

GHSA-PW25-C82R-75MM

Affected Products

Request-Filtering-Agent

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57814.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-57814 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pw25-c82r-75mm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57814 · Security Note
• https://github.com/azu/request-filtering-agent · Note
• https://github.com/azu/request-filtering-agent/security/advisories/GHSA-pw25-c82r-75mm · Note
• https://t.me/CVEtracker/30871 · Telegram Post
• https://twitter.com/CVEnew/status/1960103786854166641 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1960266253215355379 · Twitter Post
• https://t.me/cveNotify/133366 · Telegram Post
• https://github.com/azu/request-filtering-agent-https127-test · Note