CVE-2026-33752 Redirect-based SSRF leading to internal network access in curl_cffi (with TLS impersonation bypass)
Attackers can exploit redirect handling and TLS impersonation in curl_cffi to access internal network services and bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33752?
CVE-2026-33752 is a high-severity server-side request forgery vulnerability in lexiforest curl_cffi, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
curl_cffi is the a Python binding for curl. Prior to 0.15.0, curl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. This vulnerability is fixed in 0.15.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-33752?
3 open source packages ship an affected version, including curl_cffi and curl-cffi. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
curl_cffi PyPI | All versions | 0.15.0 |
curl-cffi PyPI | All versions | 0.15.0 |
curl-cffi PyPI | All versions | 0.15.0 |
Products include Lexiforest Curl Cffi.
How do I fix CVE-2026-33752?
Upgrade curl_cffi to 0.15.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-33752 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33752 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-qw2m-4pqf-rmpp, PYSEC-2026-2431.