{"schema":"threatline.record/2","record":{"id":"CVE-2026-111171","aliases":["CVE-2026-40072","GHSA-5hr4-253g-cpx2","PYSEC-2026-3414"],"summary":"Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass","details":"Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA records, making clients with CCIP Read enabled send requests to loopback, private, or link-local services.","categories":["Libraries & packages"],"product":"web3.py","vendor":"ethereum","ecosystem":"PyPI","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111171","source_modified_at":"2026-10-15T19:29:53.958Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"web3.py","vendor":"ethereum","versions":[{"version":"7.15.0","lessThanOrEqual":"7.16.0","status":"affected","versionType":"semver"},{"version":"8.0.0b2","lessThanOrEqual":"8.0.0","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-5hr4-253g-cpx2","source_modified_at":"2026-10-16T10:55:39.246095876Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"web3","ecosystem":"PyPI","purl":"pkg:pypi/web3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0b3"},{"fixed":"7.15.0"}]}],"versions":["6.0.0","6.0.0b10","6.0.0b11","6.0.0b3","6.0.0b4","6.0.0b5","6.0.0b6","6.0.0b7","6.0.0b8","6.0.0b9","6.1.0","6.10.0","6.11.0","6.11.1","6.11.2","6.11.3","6.11.4","6.12.0","6.13.0","6.14.0","6.15.0","6.15.1","6.16.0","6.17.0","6.17.1","6.17.2","6.18.0","6.19.0","6.2.0","6.20.0","6.20.1","6.20.2","6.20.3","6.20.4","6.3.0","6.4.0","6.5.0","6.6.0","6.6.1","6.7.0","6.8.0","6.9.0","7.0.0","7.0.0b1","7.0.0b2","7.0.0b3","7.0.0b4","7.0.0b5","7.0.0b6","7.0.0b7"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-5hr4-253g-cpx2","source_modified_at":"2026-10-16T10:55:39.246095876Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"web3","ecosystem":"PyPI","purl":"pkg:pypi/web3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0b1"},{"fixed":"8.0.0b2"}]}],"versions":["8.0.0b1"]}],"fixed_versions":[{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-5hr4-253g-cpx2","source_modified_at":"2026-10-16T10:55:39.246095876Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"web3","ecosystem":"PyPI","purl":"pkg:pypi/web3"},"version":"7.15.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-5hr4-253g-cpx2","source_modified_at":"2026-10-16T10:55:39.246095876Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"web3","ecosystem":"PyPI","purl":"pkg:pypi/web3"},"version":"8.0.0b2"}],"cvss":6.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00341,"percentile":0.26423,"score_date":"2026-10-23"},"published_at":"2026-10-15T18:57:55.904Z","modified_at":"2026-10-16T10:55:39.246095876Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-111171","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T19:29:53.958Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-5hr4-253g-cpx2","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T10:55:39.246095876Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111171","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/ethereum/web3.py/pull/3875","tags":["issue-tracking","technical-description","patch"]},{"source":"CVE List","url":"https://github.com/ethereum/web3.py/blob/c8c1ed0c9e77e1a8b74902e6a6825e0b00534b10/web3/utils/ccip_url_validation.py#L16-L57","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/ethereum/web3.py/security/advisories/GHSA-5hr4-253g-cpx2","tags":["related","vendor-advisory"]},{"source":"CVE List","url":"https://github.com/ethereum/web3.py","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/web3-py-7.15.0-through-7.16.0-and-8.0-0b2-through-8.0.0-ccip-read-ssrf-bypass","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://github.com/ApeWorX/web3.py/security/advisories/GHSA-5hr4-253g-cpx2","tags":["exploit"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-15T19:29:17.459655Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-16T10:55:39.246095876Z","content_hash":"27a1da744af029479a8d23634515a8072079d662ce3de9a53460d729532f68cc"}}