curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)

The SSRF vulnerability in curl-cffi arises from the library's failure to restrict requests to internal IP ranges and its automatic following of redirects through libcurl. An attacker can craft a malicious URL that redirects requests to internal resources, such as cloud metadata endpoints, which often contain sensitive information like API keys, instance details, and credentials. The TLS impersonation feature exacerbates the risk, as it can make these requests appear as legitimate browser traffic, potentially bypassing network security controls and firewalls. Successful exploitation could lead to data breaches, unauthorized access to internal systems, and potential compromise of the entire infrastructure.

Applications and services that rely on the curl-cffi Python library for making HTTP requests are at risk. This includes web applications, automation scripts, and any other Python-based tools that utilize curl-cffi. Specifically, environments where curl-cffi is used to interact with cloud metadata endpoints or other internal services are particularly vulnerable.

• python / library:

import subprocess
result = subprocess.run(['pip', 'show', 'curl-cffi'], capture_output=True, text=True)
if 'Version:' in result.stdout:
    version = result.stdout.split('Version:')[1].strip().split('\n')[0]
    if version <= '0.9.0b2':
        print('Vulnerable version of curl-cffi detected!')

• generic web:

curl -I https://your-application-url/ | grep -i 'Server:'

• generic web:

curl -I https://your-application-url/ | grep -i 'X-Powered-By:'

1. 2026-04-03Disclosure

   disclosure

1. Reserviert2026-03-23
2. Veröffentlicht2026-04-03
3. Geändert2026-04-06
4. EPSS aktualisiert2026-04-14

The primary mitigation for CVE-2026-33752 is to upgrade the curl-cffi library to version 0.15.0 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These may include restricting outbound network access for applications using curl-cffi, implementing strict URL validation and sanitization to prevent redirection to internal IPs, and utilizing a Web Application Firewall (WAF) to filter malicious requests. Monitor network traffic for suspicious outbound connections to internal IP addresses. After upgrading, verify the fix by attempting to access a known internal resource via curl-cffi and confirming that the request is blocked or denied.