p PatchFirst

CVE-2026-111171

CVE-2026-111171 · Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA records, making clients with CCIP Read enabled send requests to loopback, private, or link-local services.

CVSS 6.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • web3.py

    Versions
    • ≥ 7.15.0, ≤ 7.16.0: Affected (semver)
    • ≥ 8.0.0b2, ≤ 8.0.0: Affected (custom)

    No fix published

  • web3 PyPI

    Versions
    • 6.0.0
    • 6.0.0b10
    • 6.0.0b11
    • 6.0.0b3
    • 6.0.0b4
    • 6.0.0b5
    • 6.0.0b6
    • 6.0.0b7
    • 6.0.0b8
    • 6.0.0b9
    • 6.1.0
    • 6.10.0
    • 6.11.0
    • 6.11.1
    • 6.11.2
    • 6.11.3
    • 6.11.4
    • 6.12.0
    • 6.13.0
    • 6.14.0
    • 6.15.0
    • 6.15.1
    • 6.16.0
    • 6.17.0
    • 6.17.1
    • 6.17.2
    • 6.18.0
    • 6.19.0
    • 6.2.0
    • 6.20.0
    • 6.20.1
    • 6.20.2
    • 6.20.3
    • 6.20.4
    • 6.3.0
    • 6.4.0
    • 6.5.0
    • 6.6.0
    • 6.6.1
    • 6.7.0
    • 6.8.0
    • 6.9.0
    • 7.0.0
    • 7.0.0b1
    • 7.0.0b2
    • 7.0.0b3
    • 7.0.0b4
    • 7.0.0b5
    • 7.0.0b6
    • 7.0.0b7
    • 7.0.0b8
    • 7.0.0b9
    • 7.1.0
    • 7.10.0
    • 7.11.0
    • 7.11.1
    • 7.12.0
    • 7.12.1
    • 7.13.0
    • 7.14.0
    • 7.14.1
    • 7.2.0
    • 7.3.0
    • 7.3.1
    • 7.4.0
    • 7.5.0
    • 7.6.0
    • 7.6.1
    • 7.7.0
    • 7.8.0
    • 7.9.0
    Affected ranges
    • ECOSYSTEM: ≥ 6.0.0b3, < 7.15.0

    Update to 7.15.0

  • web3 PyPI

    Versions
    • 8.0.0b1
    Affected ranges
    • ECOSYSTEM: ≥ 8.0.0b1, < 8.0.0b2

    Update to 8.0.0b2

  • web3 PyPI

    Versions
    • 6.0.0
    • 6.0.0b10
    • 6.0.0b11
    • 6.0.0b3
    • 6.0.0b4
    • 6.0.0b5
    • 6.0.0b6
    • 6.0.0b7
    • 6.0.0b8
    • 6.0.0b9
    • 6.1.0
    • 6.10.0
    • 6.11.0
    • 6.11.1
    • 6.11.2
    • 6.11.3
    • 6.11.4
    • 6.12.0
    • 6.13.0
    • 6.14.0
    • 6.15.0
    • 6.15.1
    • 6.16.0
    • 6.17.0
    • 6.17.1
    • 6.17.2
    • 6.18.0
    • 6.19.0
    • 6.2.0
    • 6.20.0
    • 6.20.1
    • 6.20.2
    • 6.20.3
    • 6.20.4
    • 6.3.0
    • 6.4.0
    • 6.5.0
    • 6.6.0
    • 6.6.1
    • 6.7.0
    • 6.8.0
    • 6.9.0
    • 7.0.0
    • 7.0.0b1
    • 7.0.0b2
    • 7.0.0b3
    • 7.0.0b4
    • 7.0.0b5
    • 7.0.0b6
    • 7.0.0b7
    • 7.0.0b8
    • 7.0.0b9
    • 7.1.0
    • 7.10.0
    • 7.11.0
    • 7.11.1
    • 7.12.0
    • 7.12.1
    • 7.13.0
    • 7.14.0
    • 7.14.1
    • 7.2.0
    • 7.3.0
    • 7.3.1
    • 7.4.0
    • 7.5.0
    • 7.6.0
    • 7.6.1
    • 7.7.0
    • 7.8.0
    • 7.9.0
    • 8.0.0b1
    Affected ranges
    • ECOSYSTEM: ≥ 6.0.0b3, < 7.15.0 ∪ ≥ 8.0.0b1, < 8.0.0b2

    Update to 7.15.0; Update to 8.0.0b2

Original sources

Check your server →