The CVSS 7.3 score assigned to PullMD 3.2.0's SSRF vulnerability creates an urgency signal that the EPSS probability of 0.00352 (below 0.4% over 30 days) directly contradicts. These aren't conflicting metrics — they're measuring different dimensions of risk, and recognizing that distinction is essential for correct prioritization.
The CVE identifies 'url' as the manipulated parameter in the /api endpoint but omits critical context: whether this endpoint requires authentication, what HTTP methods trigger the behavior, and whether the affected server has outbound network access. SSRF severity hinges on these deployment characteristics far more than on the CVSS base score. An authenticated endpoint on an isolated server with no VPC connectivity is substantially lower risk than an unauthenticated endpoint on a server deployed alongside cloud metadata services or internal admin panels. The CVSS metric captures potential impact assuming trivial exploitation; EPSS models actual exploitation probability in the wild. The disconnect between them here likely reflects narrow trigger conditions — either the endpoint requires credentials, or the typical PullMD deployment has limited outbound access, or both.
Before allocating patching resources, verify three conditions: whether the /api endpoint requires valid authentication; whether the PullMD instance can reach cloud metadata endpoints (169.254.169.254), internal APIs, or database services; and whether the instance sits in an isolated container or directly on a production host. If the endpoint is authenticated and PullMD runs in a restricted network segment, the EPSS probability is probably reflecting reality and the CVSS score overstates urgency. If the instance sits adjacent to cloud infrastructure or internal services with broad network access, the blast radius of a successful SSRF could be severe regardless of authentication requirements — an internal actor or compromised credential would face no EPSS-modeled barrier at all.
A secondary concern: the patch exists (commit hash 96448894cc93ccecb0bdcbf263a9d25390a8455e), and the gap between the vendor's internal fix and public disclosure creates a window where actively monitored systems receive patches while abandoned or forgotten instances do not. The EPSS model derives from telemetry on monitored infrastructure and is structurally blind to these legacy deployments. Over time, the subset of unpatched instances increasingly consists of forgotten systems — precisely the ones most likely to sit in sensitive network positions. The EPSS score will remain low because it measures new exploitation attempts, not the compounding risk in long-tail deployments.
For practical prioritization: confirm authentication requirements and deployment topology before treating this as a high-urgency patch. In isolated or authenticated contexts, the SSRF is a lower-priority finding. In connected deployments near cloud metadata or internal services, prioritize the patch regardless of the EPSS score.