64 matches found
Rocky Linux 8.8 [CIQ] Security Update: python39-cffi / python39-cffi-debuginfo (ciqsa-2026_1139)
The Rocky Linux 8.8 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261139 advisory. This advisory aggregates security fixes for the python-cffi SRPM in CIQ LTS 8.8. It addresses 1 CVE: CVE-2024-6345. Tenable has extracted the preceding descriptio...
Rocky Linux 8.6 [CIQ] Security Update: python39-cffi / python39-cffi-debuginfo (ciqsa-2026_0226)
The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260226 advisory. This advisory aggregates security fixes for the python-cffi SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2021-28861. Tenable has extracted the preceding descripti...
Rocky Linux 8.6 [CIQ] Security Update: python39-cffi / python39-cffi-debuginfo Multiple Vulnerabilities (ciqsa-2026_0763)
The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260763 advisory. This advisory aggregates security fixes for the python-cffi SRPM in CIQ LTS 8.6. It addresses 4 CVEs: CVE-2015-20107, CVE-2020-10735, CVE-2021-28861,...
Rocky Linux 8.6 [CIQ] Security Update: python38-cffi / python38-cffi-debuginfo Multiple Vulnerabilities (ciqsa-2026_0200)
The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260200 advisory. This advisory aggregates security fixes for the python-cffi SRPM in CIQ LTS 8.6. It addresses 4 CVEs: CVE-2015-20107, CVE-2020-10735, CVE-2021-28861,...
alpaxa-quant (>=1.0.0, <=1.0.2), amazon-wishlist-exporter (2024.12.7) +119 more potentially affected by CVE-2026-33752 via curl-cffi (>=0.5.6, <=0.14.0)
curl-cffi PYPI version =0.5.6, =1.0.0, =0.1.0, =1.1.5, =2.0.0, =1.0.0, =0.1.0a4, =0.9.16, =2.0.0, =0.1.0, =0.1.0, =0.3.0b22, =0.3.1 and more Source cves: CVE-2026-33752 Source advisory: OSV:PYSEC-2026-2431...
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
Summarycurlcffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl.Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curlcffi’s TLS impersonation featu...
openSUSE 16 Security Update : python-PyNaCl (openSUSE-SU-2026:20650-1)
The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20650-1 advisory. Security fixes: - CVE-2025-69277: incorrect validation of elliptic curve points certain custom cryptography or untrusted data to...
SUSE-SU-2026:21431-1 Security update for python-PyNaCl
This update for python-PyNaCl fixes the following issues: Security fixes: - CVE-2025-69277: incorrect validation of elliptic curve points certain custom cryptography or untrusted data to cryptocoreed25519isvalidpoint function bsc1255764. Other fixes: - update to 1.6.2 bsc1255764, CVE-2025-69277:...
CVE-2026-33752
curlcffi is the a Python binding for curl. Prior to 0.15.0, curlcffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata...
CVE-2026-33752
CVE-2026-33752 affects the Python binding curl_cffi for libcurl. Before version 0.15.0, curl_cffi does not restrict outbound requests to internal IP ranges and follows redirects automatically via libcurl. This enables an attacker-controlled URL to redirect to internal services (e.g., cloud metada...
alpaxa-quant (>=1.0.0, <=1.0.2), amazon-wishlist-exporter (2024.12.7) +119 more potentially affected by CVE-2026-33752 via curl-cffi (>=0.5.6, <=0.14.0)
curl-cffi PYPI version =0.5.6, =1.0.0, =0.1.0, =1.1.5, =2.0.0, =1.0.0, =0.1.0a4, =0.9.16, =2.0.0, =0.1.0, =0.1.0, =0.3.0b22, =0.3.1 and more Source cves: CVE-2026-33752 Source advisory: MEND:CVE-2026-33752...
CVE-2026-33752 Redirect-based SSRF leading to internal network access in curl_cffi (with TLS impersonation bypass)
curlcffi is the a Python binding for curl. Prior to 0.15.0, curlcffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata...
CVE-2026-33752 Redirect-based SSRF leading to internal network access in curl_cffi (with TLS impersonation bypass)
curlcffi is the a Python binding for curl. Prior to 0.15.0, curlcffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata...
curl_cffi code issue vulnerability
curlcffi is a Python HTTP client library developed by Lexiforest personal developers, which supports browser fingerprint simulation. Versions of curlcffi prior to 0.15.0 have code vulnerabilities. These vulnerabilities stem from the lack of restrictions on requests directed to internal IP ranges,...
alpaxa-quant (>=1.0.0, <=1.0.2), amazon-wishlist-exporter (2024.12.7) +119 more potentially affected by CVE-2026-33752 via curl-cffi (>=0.5.6, <=0.14.0)
curl-cffi PYPI version =0.5.6, =1.0.0, =0.1.0, =1.1.5, =2.0.0, =1.0.0, =0.1.0a4, =0.9.16, =2.0.0, =0.1.0, =0.1.0, =0.3.0b22, =0.3.1 and more Source cves: CVE-2026-33752 Source advisory: SNYK:PYTHON-CURLCFFI-15907859...
alpaxa-quant (>=1.0.0, <=1.0.2), amazon-wishlist-exporter (2024.12.7) +119 more potentially affected by CVE-2026-33752 via curl-cffi (>=0.5.6, <=0.14.0)
curl-cffi PYPI version =0.5.6, =1.0.0, =0.1.0, =1.1.5, =2.0.0, =1.0.0, =0.1.0a4, =0.9.16, =2.0.0, =0.1.0, =0.1.0, =0.3.0b22, =0.3.1 and more Source cves: CVE-2026-33752 Source advisory: GHSA-QW2M-4PQF-RMPP...
alpaxa-quant (>=1.0.0, <=1.0.2), amazon-wishlist-exporter (2024.12.7) +119 more potentially affected by CVE-2026-33752 via curl-cffi (>=0.5.6, <=0.14.0)
curl-cffi PYPI version =0.5.6, =1.0.0, =0.1.0, =1.1.5, =2.0.0, =1.0.0, =0.1.0a4, =0.9.16, =2.0.0, =0.1.0, =0.1.0, =0.3.0b22, =0.3.1 and more Source cves: CVE-2026-33752 Source advisory: OSV:GHSA-QW2M-4PQF-RMPP...
Server-side Request Forgery (SSRF)
Overview curl-cffi is a python binding for curl-impersonate via cffi. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the handling of user-supplied URLs and automatic redirect following in the get function. An attacker can access internal network resources...
PT-2026-30271
Name of the Vulnerable Software and Affected Versions curl cffi affected versions not specified Description curl cffi does not restrict requests to internal IP ranges and automatically follows redirects via libcurl. This allows an attacker-controlled URL to redirect requests to internal services,...
