CVE-2026-33752
CVE-2026-33752 · Redirect-based SSRF leading to internal network access in curl_cffi (with TLS impersonation bypass)
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
curl_cffi is the a Python binding for curl. Prior to 0.15.0, curl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. This vulnerability is fixed in 0.15.0.
CVSS 8.6 · Élevée · EPSS 0,5% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: python
Produits et versions concernés
curl_cffi
- Versions du logiciel
- < 0.15.0: Concernée
Aucun correctif publié
curl-cffi PyPI
- Versions du logiciel
- 0.1.5
- 0.10.0
- 0.10.0b1
- 0.10.0b2
- 0.11.0
- 0.11.0b1
- 0.11.0b2
- 0.11.1
- 0.11.2
- 0.11.3
- 0.11.4
- 0.12.0
- 0.12.0b1
- 0.12.1b1
- 0.12.1b2
- 0.13.0
- 0.13.0b1
- 0.14.0
- 0.14.0b1
- 0.14.0b2
- 0.14.0b3
- 0.14.0b4
- 0.14.0b5
- 0.15.0b1
- 0.15.0b2
- 0.15.0b3
- 0.15.0b4
- 0.15.0b5
- 0.15.0b6
- 0.15.0rc1
- 0.2.0
- 0.2.1
- 0.2.4
- 0.2.5
- 0.3.0
- 0.3.1
- 0.3.2
- 0.3.7
- 0.3.8
- 0.4.0
- 0.5.0
- 0.5.1
- 0.5.10
- 0.5.10b1
- 0.5.10b2
- 0.5.10b3
- 0.5.10b4
- 0.5.10b5
- 0.5.2
- 0.5.3
- 0.5.4
- 0.5.5
- 0.5.6
- 0.5.7
- 0.5.9
- 0.5.9b1
- 0.5.9b2
- 0.5.9b3
- 0.5.9b4
- 0.5.9b5
- 0.5.9b6
- 0.6.0
- 0.6.0b2
- 0.6.0b4
- 0.6.0b7
- 0.6.0b9
- 0.6.1
- 0.6.2
- 0.6.3
- 0.6.3b1
- 0.6.4
- 0.7.0
- 0.7.0b4
- 0.7.0b6
- 0.7.0b7
- 0.7.1
- 0.7.2
- 0.7.3
- 0.7.3b1
- 0.7.4
- 0.8.0b1
- 0.8.0b3
- 0.8.0b6
- 0.8.0b7
- 0.8.1b8
- 0.8.1b9
- 0.9.0
- 0.9.0b1
- 0.9.0b2
- Plages de versions concernées
- ECOSYSTEM: < 0.15.0
Mettez à jour vers 0.15.0