Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA records, making clients with CCIP Read enabled send requests to loopback, private, or link-local services.

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00341.

Exploitation poc

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
ethereum web3.py unaffected
Version Status Constraints
7.15.0 affected ≤ 7.16.0
8.0.0b2 affected ≤ 8.0.0

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/ApeWorX/web3.py/security/advisories/GHSA-5hr4-253g-cpx2 cve-icon cve-icon
https://github.com/ethereum/web3.py cve-icon cve-icon
https://github.com/ethereum/web3.py/blob/c8c1ed0c9e77e1a8b74902e6a6825e0b00534b10/web3/utils/ccip_url_validation.py#L16-L57 cve-icon cve-icon
https://github.com/ethereum/web3.py/pull/3875 cve-icon cve-icon
https://github.com/ethereum/web3.py/security/advisories/GHSA-5hr4-253g-cpx2 cve-icon cve-icon
https://www.vulncheck.com/advisories/web3-py-7.15.0-through-7.16.0-and-8.0-0b2-through-8.0.0-ccip-read-ssrf-bypass cve-icon cve-icon
History

Thu, 15 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA records, making clients with CCIP Read enabled send requests to loopback, private, or link-local services.
Title Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-15T19:29:53.958Z

Reserved: 2026-10-15T17:04:07.296Z

Link: CVE-2026-111171

cve-icon Vulnrichment

Updated: 2026-10-15T19:29:40.476Z

cve-icon NVD

Status : Received

Published: 2026-10-15T19:17:33.300

Modified: 2026-10-15T20:17:12.173

Link: CVE-2026-111171

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses