PT-2026-30271 · Pypi+1 · Curl-Cffi+1

Redyank · Published 2026-04-03 · Updated 2026-04-06 · CVE-2026-33752

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions curl cffi (affected versions not specified)

Description curl cffi does not restrict requests to internal IP ranges and automatically follows redirects via libcurl. This allows an attacker-controlled URL to redirect requests to internal services, such as cloud metadata endpoints. Additionally, curl cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, potentially bypassing network controls. The issue arises because user-supplied URLs are passed directly to libcurl without validation of internal IP ranges, redirects are automatically followed, and there is no validation of redirect destinations at the Python layer. An attacker can provide a URL pointing to their server, which redirects to an internal service, allowing access to internal endpoints. The TLS fingerprint impersonation feature can further help bypass TLS-based filtering controls.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-33752

GHSA-QW2M-4PQF-RMPP

Affected Products

Curl-Cffi

Libcurl

References · 6

• 🔥 https://github.com/lexiforest/curl_cffi/security/advisories/GHSA-qw2m-4pqf-rmpp · Exploit
• https://osv.dev/vulnerability/GHSA-qw2m-4pqf-rmpp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33752 · Security Note
• https://github.com/lexiforest/curl_cffi · Note
• https://twitter.com/pulsepatchio/status/2040441194661003758 · Twitter Post
• https://twitter.com/CveFindCom/status/2041195030233174363 · Twitter Post