All vulnerabilities
CVE-2026-111171CVE-2026-40072GHSA-5hr4-253g-cpx2PYSEC-2026-3414

Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass

ethereum web3.pyPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 15 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7.15.0Also 8.0.0b2OSV
Published15 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

  • 7.15.0web3, PyPIOSVpip install "web3>=7.15.0"
  • 8.0.0b2web3, PyPIOSVpip install "web3>=8.0.0b2"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA records, making clients with CCIP Read enabled send requests to loopback, private, or link-local services.

Text from CVE List

Affected versions 55

  • web3.pyaffected: 7.15.0 through 7.16.0CVE List
  • web3.pyaffected: 8.0.0b2 through 8.0.0CVE List
  • web3, PyPIfrom 6.0.0b3, fixed in 7.15.0OSV
  • web3, PyPI6.0.0OSV
  • web3, PyPI6.0.0b10OSV
  • web3, PyPI6.0.0b11OSV
  • web3, PyPI6.0.0b3OSV
  • web3, PyPI6.0.0b4OSV
  • web3, PyPI6.0.0b5OSV
  • web3, PyPI6.0.0b6OSV
  • web3, PyPI6.0.0b7OSV
  • web3, PyPI6.0.0b8OSV
  • web3, PyPI6.0.0b9OSV
  • web3, PyPI6.1.0OSV
  • web3, PyPI6.10.0OSV
  • web3, PyPI6.11.0OSV
  • web3, PyPI6.11.1OSV
  • web3, PyPI6.11.2OSV
  • web3, PyPI6.11.3OSV
  • web3, PyPI6.11.4OSV
  • web3, PyPI6.12.0OSV
  • web3, PyPI6.13.0OSV
  • web3, PyPI6.14.0OSV
  • web3, PyPI6.15.0OSV
  • web3, PyPI6.15.1OSV
  • web3, PyPI6.16.0OSV
  • web3, PyPI6.17.0OSV
  • web3, PyPI6.17.1OSV
  • web3, PyPI6.17.2OSV
  • web3, PyPI6.18.0OSV
  • web3, PyPI6.19.0OSV
  • web3, PyPI6.2.0OSV
  • web3, PyPI6.20.0OSV
  • web3, PyPI6.20.1OSV
  • web3, PyPI6.20.2OSV
  • web3, PyPI6.20.3OSV
  • web3, PyPI6.20.4OSV
  • web3, PyPI6.3.0OSV
  • web3, PyPI6.4.0OSV
  • web3, PyPI6.5.0OSV
  • web3, PyPI6.6.0OSV
  • web3, PyPI6.6.1OSV
  • web3, PyPI6.7.0OSV
  • web3, PyPI6.8.0OSV
  • web3, PyPI6.9.0OSV
  • web3, PyPI7.0.0OSV
  • web3, PyPI7.0.0b1OSV
  • web3, PyPI7.0.0b2OSV
  • web3, PyPI7.0.0b3OSV
  • web3, PyPI7.0.0b4OSV
  • web3, PyPI7.0.0b5OSV
  • web3, PyPI7.0.0b6OSV
  • web3, PyPI7.0.0b7OSV
  • web3, PyPIfrom 8.0.0b1, fixed in 8.0.0b2OSV
  • web3, PyPI8.0.0b1OSV

References 6