# web3 (PyPI) vulnerabilities 2 known vulnerabilities (1 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 8.0.0 (Aug 31, 2026): no advisory affects it - Newest unaffected release: 8.0.0 (Aug 31, 2026), the latest release - Weekly downloads: 1.3M - Dependents: 862 - Releases: 252 since 0.1.7 (Apr 28, 2016) - Registry: https://pypi.org/project/web3/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-111171: 6.0.0b3 to 7.14.1 (7.15.0 is outside it); 8.0.0b1 (8.0.0b2 is outside it) - CVE-2026-40072: 6.0.0b3 to 7.14.1 (7.15.0 is outside it); 8.0.0b1 (8.0.0b2 is outside it) ## Advisories (2) ### [CVE-2026-111171](https://cve.now/CVE-2026-111171): Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass - Severity: Medium 6.3 - Published: Oct 15, 2026 - Affected: from 6.0.0b3, fixed in 7.15.0; from 8.0.0b1, fixed in 8.0.0b2; from 6.0.0b3, fixed in 7.15.0; from 8.0.0b1, fixed in 8.0.0b2. - Fixed in 7.15.0 (released Apr 2, 2026, 196 days before disclosure) and 8.0.0b2 (released Apr 2, 2026, 196 days before disclosure). - The latest release, 8.0.0, is not affected. ### [CVE-2026-40072](https://cve.now/CVE-2026-40072): web3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling - Severity: Low 1.7 - Published: Apr 9, 2026 - Affected: from 6.0.0b3, fixed in 7.15.0; from 8.0.0b1, fixed in 8.0.0b2; from 6.0.0b3, fixed in 7.15.0; from 8.0.0b1, fixed in 8.0.0b2. - Fixed in 7.15.0 (released Apr 2, 2026, 7 days before disclosure) and 8.0.0b2 (released Apr 2, 2026, 7 days before disclosure). - The latest release, 8.0.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/web3 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.