Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

web3

2 known vulnerabilities (1 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
8.0.0 (Aug 31, 2026): no advisory affects it
Newest unaffected release
8.0.0 (Aug 31, 2026), the latest release
Advisories
2 · 1 medium, 1 low
Weekly downloads
1.3M
Dependents
862
Releases
252 since 0.1.7 (Apr 28, 2016)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-111171
    Affects 6.0.0b3 to 7.14.1 (7.15.0 is outside it); 8.0.0b1 (8.0.0b2 is outside it)
  • CVE-2026-40072
    Affects 6.0.0b3 to 7.14.1 (7.15.0 is outside it); 8.0.0b1 (8.0.0b2 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • CVE-2026-111171Medium 6.3

    Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass

    Affected: from 6.0.0b3, fixed in 7.15.0; from 8.0.0b1, fixed in 8.0.0b2; from 6.0.0b3, fixed in 7.15.0; from 8.0.0b1, fixed in 8.0.0b2.

    Fixed in 7.15.0 (released Apr 2, 2026, 196 days before disclosure) and 8.0.0b2 (released Apr 2, 2026, 196 days before disclosure).

    The latest release, 8.0.0, is not affected.

  • web3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling

    Affected: from 6.0.0b3, fixed in 7.15.0; from 8.0.0b1, fixed in 8.0.0b2; from 6.0.0b3, fixed in 7.15.0; from 8.0.0b1, fixed in 8.0.0b2.

    Fixed in 7.15.0 (released Apr 2, 2026, 7 days before disclosure) and 8.0.0b2 (released Apr 2, 2026, 7 days before disclosure).

    The latest release, 8.0.0, is not affected.