PyPI/web3 CVE-2026-111171, CVE-2026-40072: high 7.2
web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling
Action: Upgrade web3 to 7.15.0 or later.
pip install web3==7.15.0pip install web3==8.0.0b2Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.0.0b3 | 7.15.0 | - |
| 8.0.0b1 | 8.0.0b2 | - |
Fixed versions
| 7.15.0 | 8.0.0b2 |
Sources
- osv: GHSA-5hr4-253g-cpx2
- https://github.com/ethereum/web3.py/security/advisories/GHSA-5hr4-253g-cpx2
- https://nvd.nist.gov/vuln/detail/CVE-2026-40072
- https://github.com/ethereum/web3.py/commit/b1c57bb0a124359c9902daaefab4d8af7c3c4c1e
- https://github.com/ethereum/web3.py
CVE-2026-111171, CVE-2026-40072 · published · modified · JSON