logo

Database

Server-side request forgery (SSRF) In curl_cffi

Description

curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2026-337522. NVD-2026-337523. OSV-2026-337524. GHSA-qw2m-4pqf-rmpp5. GCVE-2026-337526. GHSA-qw2m-4pqf-rmpp

References

1. https://github.com/lexiforest/curl_cffi/security/advisories/GHSA-qw2m-4pqf-rmpp2. https://github.com/lexiforest/curl_cffi

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.