CVE-2026-33752
High
Description
curl_cffi is the a Python binding for curl. Prior to 0.15.0, curl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. This vulnerability is fixed in 0.15.0.
SeverityHigh
CVSS8.6
Exploit probability—
ProductLexiforest Curl Cffi
PublishedApr 6, 2026
First seenApr 6, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- lexiforest curl_cffi0.15.0 or later
- curl-cffi0.15.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lexiforest curl_cffi | v < 0.15.0, 0.15.0 | 0.15.0 |
| curl-cffiPyPI | v < 0.15.0 | 0.15.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.