CVE-2026-33752
Last modified
CVE-2026-33752 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. curl_cffi is the a Python binding for curl. Prior to 0.15.0, curl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. EPSS estimates a 0.46% chance of exploitation in the next 30 days.
Description
curl_cffi is the a Python binding for curl. Prior to 0.15.0, curl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. This vulnerability is fixed in 0.15.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Lexiforest | Curl Cffi | < 0.15.0 | — |
| Lexiforest | Curl Cffi | 0.15.0 | Beta1 |
References
- https://github.com/lexiforest/curl_cffi/security/advisories/GHSA-qw2m-4pqf-rmppExploit, Vendor Advisory
- https://github.com/lexiforest/curl_cffi/security/advisories/GHSA-qw2m-4pqf-rmppExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-33752?
How severe is CVE-2026-33752?
How do I fix CVE-2026-33752?
Are you affected by CVE-2026-33752?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST