CVE-2026-111171: Server-Side Request Forgery (SSRF) in ethereum web3.py

The vulnerability in ethereum web3.py affects versions 7.15.0 to 7.16.0 and 8.0.0b2 to 8.0.0. It is a Server-Side Request Forgery (SSRF) issue caused by improper handling of IPv4-mapped IPv6 addresses in the _check_ip_blocked() function during CCIP Read URL validation. Malicious smart contracts can exploit this by returning OffchainLookup URLs that include IPv4-mapped IPv6 hosts or AAAA DNS records. This leads to the client making unintended requests to internal network addresses such as loopback, private, or link-local services, potentially exposing internal resources.

Exploitation of this SSRF vulnerability can cause clients using the affected versions of web3.py with CCIP Read enabled to send unauthorized requests to internal network services. This may lead to information disclosure or interaction with internal services that are not intended to be accessible externally. The CVSS 4.0 score is 6.3 (medium severity), reflecting the network attack vector, high attack complexity, and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling CCIP Read functionality or avoid using affected versions. Monitor vendor communications for updates on patches or official fixes.