cve-2026-40072-ssrf-lab

CVE-2026-40072 SSRF Lab Hands-on local lab to demonstrate CVE-2026-40072 in web3.py, show the SSRF impact in Burp Suite, and verify the official fix. Overview This repository contains a safe, local-only proof of concept for CVE-2026-40072, a Server-Side Request Forgery SSRF issue tied to CCIP Rea...

CVE-2026-111171

The Web3.py library versions 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. The root cause is that the _check_ip_blocked() function fails to unwrap IPv4-mapped IPv6 addresses during CCIP Read URL validation . An attacker can u...

PT-2026-115177

Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because check ip blocked does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA...

CVE-2026-40072

web3.py allows you to interact with the Ethereum blockchain using Python. From 6.0.0b3 to before 7.15.0 and 8.0.0b2, web3.py implements CCIP Read / OffchainLookup EIP-3668 by performing HTTP requests to URLs supplied by smart contracts in offchainlookuppayload"urls". The implementation uses these...

CVE-2026-40072: Server-Side Request Forgery (SSRF)

web3.py allows you to interact with the Ethereum blockchain using Python. From 6.0.0b3 to before 7.15.0 and 8.0.0b2, web3.py implements CCIP Read / OffchainLookup EIP-3668 by performing HTTP requests to URLs supplied by smart contracts in offchainlookuppayload"urls". The implementation uses these...