CVE-2026-111171

Deferred Deferred - Pending Action

Web3.py Server-Side Request Forgery via IPv4-Mapped IPv6

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA records, making clients with CCIP Read enabled send requests to loopback, private, or link-local services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111171

EUVD

EUVD-2026-102298

Affected Vendors & Products

Vendor	Product	Version / Range
ethereum	web3.py	7.15.0
ethereum	web3.py	8.0.0b2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) in the web3.py library's CCIP Read functionality. It occurs because the _check_ip_blocked() function fails to properly handle IPv4-mapped IPv6 addresses during URL validation. Malicious smart contracts can exploit this by returning OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA records, causing clients with CCIP Read enabled to send requests to loopback, private, or link-local services.

Detection Guidance

To detect this vulnerability, monitor network traffic for unexpected HTTP requests originating from your web3.py application, particularly to loopback, private, or link-local addresses. Check logs for OffchainLookup URL processing in versions 7.15.0 through 7.16.0 or 8.0.0b2 through 8.0.0.

Impact Analysis

This vulnerability allows attackers to trick your application into making unauthorized HTTP requests to internal or restricted services. This could lead to network reconnaissance, unauthorized access to sensitive internal resources, or probing of internal network topology. The impact is higher if your application interacts with smart contracts using CCIP Read.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal systems, potentially exposing sensitive data. For GDPR, this may result in unauthorized data processing or access, violating principles of data protection. For HIPAA, unauthorized network access could compromise protected health information. Compliance violations may occur if such breaches lead to data exposure or unauthorized processing.

Mitigation Strategies

Upgrade web3.py to a patched version (7.16.1 or later, or 8.0.0b3 or later). Disable CCIP Read if not needed by setting global_ccip_read_enabled=False. Implement strict URL validation to block private/reserved IP ranges and enforce HTTPS-only requests.

Hi! I’m here to help you understand CVE-2026-111171. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70