CVE-2025-31116: MobSF Vulnerability in DNS Rebinding Leading to SSRF
Summary
CVE-2025-31116: Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Affects mobsf across 2 version ranges.
< 4.3.2
< 4b8bab5a9858c69fe13be4631b82d82186e0d3bd
Fixed in 4b8bab5a9858c69fe13be4631b82d82186e0d3bd. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mobile Security Framework (MobSF) is a comprehensive pen-testing, malware analysis, and security assessment framework. It is designed to perform both static and dynamic analysis of mobile applications, making it a vital tool for security professionals. However, MobSF has a vulnerability that affects its valid_host() function, which can be exploited through DNS rebinding techniques, potentially leading to Server-Side Request Forgery (SSRF) attacks.
Vulnerability Detail
The vulnerability arises from the use of socket.gethostbyname() in the valid_host() function, which is susceptible to DNS rebinding attacks. This flaw allows an attacker to manipulate DNS responses, tricking the application into making requests to unintended hosts. The ramifications of this vulnerability can be severe, as it may lead to unauthorized access to internal services, data leakage, or further exploitation of the system. The vulnerability has been assigned a CVSS score of 9.8, indicating its critical nature.
How To Fix
Latest published version: 4.5.3 as of 23 Oct 2026
pip install --upgrade "mobsf==4.5.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4b8bab5a9858c69fe13be4631b82d82186e0d3bd
This is the first release that contains the fix.
pip install --upgrade "mobsf==4b8bab5a9858c69fe13be4631b82d82186e0d3bd"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the vulnerable functionality until the package has been updated. Additionally, consider implementing network-level protections to mitigate the risk of DNS rebinding attacks.
Conclusion
The vulnerability identified as CVE-2025-31116 in MobSF poses a significant risk due to its potential for SSRF attacks. Users are strongly advised to update to the patched version 4.3.2 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for mobsf →
FAQ
CVE-2025-31116 is a vulnerability in the Mobile Security Framework (MobSF) that allows for Server-Side Request Forgery (SSRF) attacks due to improper handling of DNS responses.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring any installation.
Exploitation of this vulnerability can lead to unauthorized access to internal services, data leakage, and potential further exploitation of the system.
You can update MobSF by running the command pip install --upgrade mobsf in your terminal or command prompt.
DNS rebinding is a technique that allows an attacker to manipulate DNS responses to redirect requests from a victim's browser to an internal network, potentially exposing sensitive services.
References
Related vulnerabilities
Recent vulnerabilities recorded for mobsf.
