CVE-2026-19984

This SSRF vulnerability in mcp-florence2 stems from a design decision to embed HTTP client functionality in an image-processing library—a pattern that has reliably produced CVEs across the Python ecosystem. The library's `get_images` function accepts arbitrary URLs as the `src` parameter and makes outbound requests without any destination validation. This was likely added as a convenience feature after the original design, expanding the library's trust boundary from processing locally-supplied data to reaching out to arbitrary network resources on the caller's behalf. The vendor's recommended mitigation—deploying an external SSRF proxy—transfers the security burden downstream but doesn't actually fix the vulnerable code path. Any consumer calling `get_images` directly still hits the unvalidated request logic. The proxy only protects callers who intercept their own library invocations and route them through a separate infrastructure layer, which is architectural surgery rather than configuration. This creates a new attack surface: every deployed proxy becomes a chokepoint for protocol smuggling, TLS stripping, or misconfiguration probing. Three concrete actions for defenders: First, validate all URL inputs at the application layer before passing them to any library function that makes outbound requests—this is where the security boundary belongs, not in infrastructure proxies. Second, prefer libraries that don't embed HTTP clients; use dedicated HTTP clients where SSRF concerns exist at the right abstraction layer. Third, treat vendor advisories recommending infrastructure mitigations as a signal that the library's trust model has silently expanded beyond what you consented to when adding the dependency. The deeper issue is that CVSS 6.3 makes this approach look rational rather than negligent. Medium-severity SSRF in convenience libraries rarely receives the engineering attention required to close the gap between what the library does and what it should do defensively. The proxy recommendation will outlive the infrastructure assumptions it depends on—future forks will strip documentation for cleanliness, and the mitigation will decay silently until the vulnerability resurfaces as a new finding years later.

Reviewed through automated stages and approved by a human before publication.