CVE-2026-33752 Details
Description
curl_cffi is the a Python binding for curl. Prior to 0.15.0, curl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. This vulnerability is fixed in 0.15.0.
A server-side request forgery (SSRF) vulnerability has been identified in curl_cffi, a Python binding for curl, in versions through 0.15.0b4. The vulnerability arises because the library does not restrict requests to internal IP ranges and automatically follows redirects via libcurl. This allows an attacker to redirect requests to internal services, such as cloud metadata endpoints. Additionally, curl_cffi's TLS impersonation feature can make these requests appear as legitimate browser traffic, potentially bypassing certain network controls.
Users are advised to update curl_cffi to version 0.15.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lexiforest/curl_cffi/security/advisories/GHSA-qw2m-4pqf-rmpp | CISA-ADP | ExploitVendor Advisory |
| https://github.com/lexiforest/curl_cffi/security/advisories/GHSA-qw2m-4pqf-rmpp | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lexiforest curl cffi | < 0.15.0 0.15.0 beta1 0.15.0 beta2 0.15.0 beta3 0.15.0 beta4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 9, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |
| Apr 6, 2026 | CVE Modified | CISA-ADP |