Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA records, making clients with CCIP Read enabled send requests to loopback, private, or link-local services.

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Ethereum
  • Web3.py

No data.

No data.

References
Link Providers
https://github.com/ApeWorX/web3.py/security/advisories/GHSA-5hr4-253g-cpx2 cve-icon cve-icon
https://github.com/ethereum/web3.py cve-icon cve-icon
https://github.com/ethereum/web3.py/blob/c8c1ed0c9e77e1a8b74902e6a6825e0b00534b10/web3/utils/ccip_url_validation.py#L16-L57 cve-icon cve-icon
https://github.com/ethereum/web3.py/pull/3875 cve-icon cve-icon
https://github.com/ethereum/web3.py/security/advisories/GHSA-5hr4-253g-cpx2 cve-icon cve-icon
https://www.vulncheck.com/advisories/web3-py-7.15.0-through-7.16.0-and-8.0-0b2-through-8.0.0-ccip-read-ssrf-bypass cve-icon cve-icon
History

Fri, 23 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Ethereum
Ethereum web3.py
Vendors & Products Ethereum
Ethereum web3.py

Thu, 15 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA records, making clients with CCIP Read enabled send requests to loopback, private, or link-local services.
Title Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-10-15T18:57:55.904Z

Updated: 2026-10-15T19:29:53.958Z

Reserved: 2026-10-15T17:04:07.296Z

Link: CVE-2026-111171

cve-icon Vulnrichment

Updated: 2026-10-15T19:29:40.476Z

cve-icon NVD

Status : Deferred

Published: 2026-10-15T19:17:33.300

Modified: 2026-10-16T18:25:45.343

Link: CVE-2026-111171

cve-icon Redhat

No data.