curl-cffi
Python binding for curl-impersonate fork via cffi. A http client that can impersonate browser tls/ja3/http2 fingerprints.
View on Github
Activity
- Latest release
- 1w ago
- Total releases
- 101
- Cadence
- ~7 days
- Last 12 months
- 23
Reach
- Stars
- 6.5k
Details
- License
- MIT
- First release
- Aug 23, 2022
| Version | Released | |
|---|---|---|
0.16.3
patch
| ||
0.16.3b1
pre
| ||
0.16.2
patch
| ||
0.16.2b1
pre
| ||
0.16.1
patch
| ||
0.16.1b1
pre
| ||
0.16.0
minor
| ||
0.16.0b2
pre
| ||
0.16.0b1
pre
| ||
0.15.1b2
pre
| ||
0.15.1b1
pre
| ||
0.15.0
minor
| ||
0.15.0rc1
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.15.0b6
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.15.0b5
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.15.0b4
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.15.0b3
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.15.0b2
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.15.0b1
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.14.0
minor
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.14.0b5
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.14.0b4
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.14.0b3
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.14.0b2
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.14.0b1
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.13.0
minor
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.13.0b1
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.12.1b2
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.12.1b1
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.12.0
minor
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.12.0b1
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.11.4
patch
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.11.3
patch
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.11.2
patch
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.11.1
patch
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.11.0
minor
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.11.0b2
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.11.0b1
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.10.0
minor
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.10.0b2
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.10.0b1
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.9.0
minor
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.9.0b2
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.9.0b1
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.8.1b9
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.8.1b8
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.7.4
patch
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.8.0b7
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.8.0b6
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev | ||
0.8.0b3
pre
1 CVE
CVE-2026-33752
PYSEC-2026-2431
GHSA-qw2m-4pqf-rmpp
Jul 13, 2026
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
8.6
/ 10
High
Network
Low
None
None
Changed
High
None
None
Summarycurl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. DetailsThe issue comes from how curl_cffi handles outbound requests
This means that even if an application only allows requests to external URLs, an attacker can
As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed. Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources. PoC
Victim code: Result
In some environments, this may help the request bypass TLS-based filtering controls. ImpactAn attacker who can control the requested URL may be able to:
Affected versions
0.1.5
0.10.0
0.10.0b1
0.10.0b2
0.11.0
0.11.0b1
0.11.0b2
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
+ 77 more Show less
0.12.0b1
0.12.1b1
0.12.1b2
0.13.0
0.13.0b1
0.14.0
0.14.0b1
0.14.0b2
0.14.0b3
0.14.0b4
0.14.0b5
0.15.0b1
0.15.0b2
0.15.0b3
0.15.0b4
0.15.0b5
0.15.0b6
0.15.0rc1
0.2.0
0.2.1
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.7
0.3.8
0.4.0
0.5.0
0.5.1
0.5.10
0.5.10b1
0.5.10b2
0.5.10b3
0.5.10b4
0.5.10b5
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.9
0.5.9b1
0.5.9b2
0.5.9b3
0.5.9b4
0.5.9b5
0.5.9b6
0.6.0
0.6.0b2
0.6.0b4
0.6.0b7
0.6.0b9
0.6.1
0.6.2
0.6.3
0.6.3b1
0.6.4
0.7.0
0.7.0b4
0.7.0b6
0.7.0b7
0.7.1
0.7.2
0.7.3
0.7.3b1
0.7.4
0.8.0b1
0.8.0b3
0.8.0b6
0.8.0b7
0.8.1b8
0.8.1b9
0.9.0
0.9.0b1
0.9.0b2
Fixed in
0.15.0
References Updated Jul 13, 2026 · Source: OSV.dev |