CVE-2026-33752

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-33752

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33752.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-33752

Aliases

Published

2026-04-06T15:01:44.844Z

Modified

2026-07-15T01:49:11.870007620Z

Severity

8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator

Summary

Redirect-based SSRF leading to internal network access in curl_cffi (with TLS impersonation bypass)

Details

curlcffi is the a Python binding for curl. Prior to 0.15.0, curlcffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. This vulnerability is fixed in 0.15.0.

Database specific

{
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33752.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/lexiforest/curl_cffi

Affected ranges

Type

GIT

Repo

https://github.com/lexiforest/curl_cffi

Events

Introduced

Fixed

0e219c43701f955436ef4a20486a7237a417dbc6

Database specific

{
    "cpe": "cpe:2.3:a:lexiforest:curl_cffi:*:*:*:*:*:python:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.15.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

0.*

0.8.1b8

v0.*

v0.1.5

v0.10.0

v0.10.0b1

v0.10.0b2

v0.11.0

v0.11.0b1

v0.11.0b2

v0.11.1

v0.11.2

v0.11.3

v0.11.4

v0.12.0

v0.12.0b1

v0.12.1b1

v0.12.1b2

v0.13.0

v0.13.0b1

v0.14.0

v0.14.0b1

v0.14.0b2

v0.14.0b3

v0.14.0b4

v0.14.0b5

v0.15.0b1

v0.15.0b2

v0.15.0b3

v0.15.0b4

v0.15.0b5

v0.15.0b6

v0.15.0rc1

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.3.0

v0.3.1

v0.3.2

v0.3.6

v0.3.7

v0.3.8

v0.4.0

v0.5.0

v0.5.1

v0.5.10

v0.5.10b1

v0.5.10b2

v0.5.10b3

v0.5.10b4

v0.5.10b5

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.5.8

v0.5.8.1

v0.5.9

v0.5.9b1

v0.5.9b2

v0.5.9b3

v0.5.9b4

v0.5.9b5

v0.5.9b6

v0.6.0

v0.6.0b7

v0.6.0b9

v0.6.1

v0.6.2

v0.6.3b1

v0.7.0

v0.7.0b4

v0.7.0b6

v0.7.0b7

v0.7.1

v0.7.2

v0.8.0

v0.8.0b1

v0.8.0b3

v0.8.0b4

v0.8.0b5

v0.8.0b6

v0.8.0b7

v0.8.1b8

v0.8.1b9

v0.9.0

v0.9.0b1

v0.9.0b2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33752.json"