curl_cffi is the a Python binding for curl. Prior to 0.15.0, curl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. This vulnerability is fixed in 0.15.0.
Fix
Public exploits 1
- redyank/CVE-2026-33752 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/lexiforest/curl_cffi/security/advisories/GHSA-qw2m-4pqf-rmpp Exploit, Vendor Advisory
- https://github.com/lexiforest/curl_cffi/security/advisories/GHSA-qw2m-4pqf-rmpp Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.6 · lexiforestNVD modified 2026-10-26 21:10
Affected (CPE criteria) 5
cpe:2.3:a:lexiforest:curl_cffi:*:*:*:*:*:python:*:*cpe:2.3:a:lexiforest:curl_cffi:0.15.0:beta1:*:*:*:python:*:*cpe:2.3:a:lexiforest:curl_cffi:0.15.0:beta2:*:*:*:python:*:*cpe:2.3:a:lexiforest:curl_cffi:0.15.0:beta3:*:*:*:python:*:*cpe:2.3:a:lexiforest:curl_cffi:0.15.0:beta4:*:*:*:python:*:*
References 2
- https://github.com/lexiforest/curl_cffi/security/advisories/GHSA-qw2m-4pqf-rmpp Exploit, Vendor Advisory
- https://github.com/lexiforest/curl_cffi/security/advisories/GHSA-qw2m-4pqf-rmpp Exploit, Vendor Advisory