CVE-2026-33752
HIGH
MEDIUM
Priority: 0.04
BB Relevance:
77/100
Published: 2026-04-06
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Changed
C:
High
I:
None
A:
None
Description
curl_cffi is the a Python binding for curl. Prior to 0.15.0, curl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. This vulnerability is fixed in 0.15.0.
Weakness Classification (1)
Affected Software (5)
| Vendor | Product | Version |
|---|---|---|
| lexiforest | curl_cffi | < 0.15.0 |
| lexiforest | curl_cffi | 0.15.0 |
| lexiforest | curl_cffi | 0.15.0 |
| lexiforest | curl_cffi | 0.15.0 |
| lexiforest | curl_cffi | 0.15.0 |
References & Advisories (1)
Exploit
Vendor Advisory