Yalantis uCrop CVE-2025-14516

No vendor-released patch is available given the unresponsive vendor. Immediate remediation requires upgrading to a patched version if available from alternative sources, or replacing uCrop with a maintained image-cropping library that includes URL validation (such as Glide or Picasso, which have built-in request filtering). If uCrop 2.2.11 cannot be replaced immediately, implement compensating controls: enforce strict URL allowlisting in the application layer before passing URLs to uCrop (validate against a whitelist of permitted image domains), disable uCrop's network-based image loading and require pre-downloaded images, or restrict outbound network access from the application using network-level controls (firewall rules preventing access to internal IP ranges and metadata services). Monitor for evidence of SSRF exploitation in application logs (requests to unexpected destinations, 169.254.169.254 cloud metadata access, or internal service ports). Each mitigation trades functionality for security - allowlisting reduces user flexibility, pre-downloading adds latency, and network restrictions may break legitimate use cases; prioritize based on application threat model.