Skip to content
OpenAdvisories
High · 8.6 Public exploit CVE-2026-33752 EUVD-2026-19293GHSA-qw2m-4pqf-rmppPYSEC-2026-2431

Redirect-based SSRF leading to internal network access in curl_cffi (with TLS impersonation bypass)

Published Apr 6, 2026 · Updated Apr 6, 2026 · Assigned by GitHub_M

Vendor: lexiforest Product: curl_cffi Package: curl-cffi Ecosystem: PyPI

Description

curl_cffi is the a Python binding for curl. Prior to 0.15.0, curl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. This vulnerability is fixed in 0.15.0.

Affected products

VendorProductAffectedFixed
lexiforest curl_cffi < 0.15.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • redyank/CVE-2026-33752 ★ 0 · Apr 3, 2026

    CVE-2026-33752(Redirect-based SSRF leading to internal network access in curl_cffi)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI curl-cffi < 0.15.0 0.15.0 GHSA-qw2m-4pqf-rmpp

References