CVE-2025-31116: Mobile Security Framework (MobSF) SSRF Vulnerability via DNS Rebinding
Summary
CVE-2025-31116: The latest deployed fix for the SSRF vulnerability is through the use of the call valid_host(). Affects mobsf versions < 4.3.2. Fixed in 4.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Mobile Security Framework (MobSF) is an open-source tool designed for mobile application security testing. It provides features such as static and dynamic analysis, and it is widely used by developers and security professionals to identify vulnerabilities in mobile applications. However, MobSF has been found to have a Server-Side Request Forgery (SSRF) vulnerability that can be exploited through DNS rebinding techniques, potentially allowing attackers to access internal resources.
Vulnerability Detail
The SSRF vulnerability in MobSF arises from the improper validation of hostnames in the 'valid_host' function. This function attempts to ensure that only valid and non-local hosts are processed. However, due to the reliance on 'socket.gethostbyname()', an attacker can manipulate DNS responses to redirect requests to internal services after the initial resolution. This can lead to unauthorized access to sensitive data or services within the network, making it a significant security risk.
How To Fix
Latest published version: 4.5.3 as of 23 Oct 2026
pip install --upgrade "mobsf==4.5.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.3.2
This is the first release that contains the fix.
pip install --upgrade "mobsf==4.3.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the 'valid_host' function to avoid using 'socket.gethostbyname()'. Instead, implement a custom hostname validation that does not rely on DNS resolution, ensuring that only explicitly allowed hosts are processed.
Conclusion
The SSRF vulnerability in MobSF poses a significant risk due to its potential for exploitation via DNS rebinding. It is crucial for users of MobSF to update to the latest version to mitigate this risk and to consider implementing additional security measures to validate hostnames.
See every vulnerability recorded for mobsf →
FAQ
The vulnerability is a Server-Side Request Forgery (SSRF) that can be exploited through DNS rebinding, allowing attackers to access internal resources.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to internal services, data leakage, and other security risks.
Yes, the vulnerability has been patched in version 4.3.2 of the MobSF package. It is recommended to upgrade to this version.
The CVSS score for this vulnerability is 4.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for mobsf.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
