CVE-2025-34469 Cowrie < 2.9.0 Unrestricted wget/curl Emulation Enables SSRF-Based DDoS Amplification
Unauthenticated attackers can abuse Cowrie's emulated wget/curl to launch SSRF-based DDoS attacks against third parties, masking their identity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-34469?
CVE-2025-34469 is a medium-severity server-side request forgery vulnerability in Cowrie, published on 31 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cowrie versions prior to 2.9.0 contain a server-side request forgery (SSRF) vulnerability in the emulated shell implementation of wget and curl. In the default emulated shell configuration, these command emulations perform real outbound HTTP requests to attacker-supplied destinations. Because no outbound request rate limiting was enforced, unauthenticated remote attackers could repeatedly invoke these commands to generate unbounded HTTP traffic toward arbitrary third-party targets, allowing the Cowrie honeypot to be abused as a denial-of-service amplification node and masking the attacker’s true source address behind the honeypot’s IP.
Weakness: CWE-918
Which versions are affected by CVE-2025-34469?
3 open source packages ship an affected version, including cowrie. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cowrie PyPI | All versions | 2.9.0 |
cowrie PyPI | All versions | 2.9.0 |
cowrie PyPI | All versions | 2.9.0 |
Products include Cowrie Cowrie.
How do I fix CVE-2025-34469?
Upgrade cowrie to 2.9.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-34469 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34469 exists.
Sources
Also known as GHSA-83jg-m2pm-4jxj, PYSEC-2026-1280.