CVE-2026-42175
- Source
- https://cve.org/CVERecord?id=CVE-2026-42175
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42175.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-42175
- Aliases
- Published
- 2026-05-12T17:52:09Z
- Modified
- 2026-10-28T02:31:10Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
- Summary
- requests-hardened: Server-Side Request Forgery (SSRF) in requests-hardened RFC 6598
- Details
-
requests-hardened is a library that overrides the default behaviors of the requests library, and adds new security features. Prior to , the SSRF protection in requests-hardened fails to block IP addresses within the RFC 6598 Shared Address Space (100.64.0.0/10). An attacker who can supply arbitrary URLs to requests-hardened could exploit this gap to access internal services hosted within 100.64.0.0/10. This is for example relevant in environments such as AWS EKS where 100.64.0.0/10 is commonly used as the default pod CIDR. The impact is environment-dependent, deployments that utilize the affected CIDR range for internal networking are exposed to SSRF bypass, while others may not be affected. This vulnerability is fixed in .
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-918" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42175.json" }- References
-
- https://github.com/saleor/requests-hardened/releases/tag/v1.2.1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42175.json
- https://github.com/saleor/requests-hardened/security/advisories/GHSA-vh75-fwv3-pqrh
- https://nvd.nist.gov/vuln/detail/CVE-2026-42175
- https://github.com/saleor/requests-hardened/commit/a266b3958bb142bca515b3c230fdea19fbda327c
- https://github.com/saleor/requests-hardened/commit/b7403f88d3b3689e57435b75b51691a160aaeef5
Affected packages
Git / github.com/saleor/requests-hardened
Affected ranges
- Type
- GIT
- Repo
- https://github.com/saleor/requests-hardened
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "1.2.1" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "a266b3958bb142bca515b3c230fdea19fbda327c" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "b7403f88d3b3689e57435b75b51691a160aaeef5" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v1.2.1", "range": [ { "fixed": "985b19ee3fa0ea0fe9b5dd63ce7bc58b84dcba0b" } ], "source": "REFERENCES_TAG" } ] }