The curl_cffi Python binding for curl versions before 0.15.0 is vulnerable to SSRF due to lack of restrictions on internal IP ranges and automatic redirect following via libcurl. An attacker can exploit this by supplying a malicious URL that redirects requests to internal network services, including sensitive cloud metadata endpoints. Additionally, curl_cffi’s TLS impersonation feature can disguise these requests as legitimate browser traffic, which may evade some network security mechanisms. The vulnerability is addressed in curl_cffi version 0.15.0.

Successful exploitation allows an attacker to make the vulnerable application send requests to internal network services that are normally inaccessible externally, such as cloud metadata endpoints. This can lead to unauthorized information disclosure. The vulnerability does not impact integrity or availability directly. There are no known exploits in the wild at this time.

Upgrade curl_cffi to version 0.15.0 or later, where this SSRF vulnerability is fixed. Since the vendor advisory does not provide additional remediation details, patching to the fixed version is the recommended action. Patch status is not explicitly confirmed beyond the fixed version statement; verify with the vendor advisory for the latest guidance.