Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck

CVE-2026-111171Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass

Medium 5.4

In plain English

A medium-severity server-side request forgery in web3.py from ethereum. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 72.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA records, making clients with CCIP Read enabled send requests to loopback, private, or link-local services.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	web3	7.15.0	GHSA-5hr4-253g-cpx2
PyPI	web3	8.0.0b2	GHSA-5hr4-253g-cpx2
PyPI	web3	7.15.0, 8.0.0b2	PYSEC-2026-3414

Affected products (as reported)

Vendor	Product	Versions
ethereum	web3.py	7.15.0 – through 7.16.08.0.0b2 – through 8.0.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

References

https://github.com/ethereum/web3.py/pull/3875 issue-tracking, technical-description, patch
https://github.com/ethereum/web3.py/blob/c8c1ed0c9e77e1a8b74902e6a6825e0b00534b10/web3/utils/ccip_url_validation.py#L16-L57 technical-description
GitHub Security Advisory (GHSA-5hr4-253g-cpx2) related, vendor-advisory
https://github.com/ethereum/web3.py product
VulnCheck Advisory: Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass third-party-advisory
https://github.com/ApeWorX/web3.py/security/advisories/GHSA-5hr4-253g-cpx2 exploit