The requests-hardened library, which enhances the Python requests library with additional security features, had an SSRF protection bypass for IP addresses in the RFC 6598 Shared Address Space (100.64.0.0/10) in versions before 1.2.1. Attackers able to control URLs passed to requests-hardened could exploit this to reach internal services within this IP range, which is commonly used in container orchestration environments such as AWS EKS. The impact depends on whether the affected CIDR is used in the deployment environment. The issue is resolved in requests-hardened version 1.2.1. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The product is a cloud service, and the vendor manages remediation for this service.

The vulnerability allows attackers to bypass SSRF protections and access internal services within the 100.64.0.0/10 IP range. This can lead to unauthorized disclosure of sensitive information hosted on internal networks. The impact is environment-dependent and primarily affects deployments using this shared address space for internal networking, such as AWS EKS clusters. There is no indication of integrity or availability impact beyond the confidentiality risk. No known exploits are reported in the wild at this time.

A fix is available in requests-hardened version 1.2.1. Users and administrators should upgrade to this version to mitigate the SSRF bypass vulnerability. Since this is a cloud service, the vendor manages remediation for the hosted environment; users should verify with the vendor that the service is updated accordingly. Patch status is confirmed as fixed in version 1.2.1. No additional mitigation steps are indicated by the vendor advisory.