Server-Side Request Forgery in Web3.py by Ethereum
CVE-2026-111171

6.3MEDIUM

Key Information:

Vendor

Ethereum

Status
Web3.py
Vendor
CVE Published:
15 October 2026

What is CVE-2026-111171?

Web3.py versions 7.15.0 through 7.16.0 and 8.0.0b2 exhibit a security vulnerability where the _check_ip_blocked() function fails to properly unwrap IPv4-mapped IPv6 addresses during CCIP Read URL validation. This oversight allows malicious contracts to potentially exploit OffchainLookup URLs containing IPv4-mapped IPv6 addresses or AAAA records. As a result, clients utilizing CCIP Read may inadvertently send requests to sensitive loopback, private, or link-local services, thereby compromising security.

Affected Version(s)

web3.py 7.15.0 <= 7.16.0

web3.py 8.0.0b2 <= 8.0.0

References

https://github.com/ethereum/web3.py/pull/3875
issue-trackingtechnical-descriptionpatch
https://github.com/ethereum/web3.py/blob/c8c1ed0c9e77e1a8...
technical-description
https://github.com/ethereum/web3.py/security/advisories/G...
relatedvendor-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SashaMIT
Zachariah Mithani
.