web3
PyPI2 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting web3page 1 of 1
- CVE-2026-111171MEDIUMCVSS 5.4EG 5.4fixed in 7.15.0 or 8.0.0b2, by version range2026-10-15
vulnerable: 6.0.0 ... 8.0.0b1 (72 versions)
Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return…
- CVE-2026-40072HIGHCVSS 7.2EG 7.2fixed in 7.15.0 or 8.0.0b2, by version range2026-04-09
vulnerable: 6.0.0 ... 8.0.0b1 (72 versions)
web3.py allows you to interact with the Ethereum blockchain using Python. From 6.0.0b3 to before 7.15.0 and 8.0.0b2, web3.py implements CCIP Read / OffchainLookup (EIP-3668) by performing HTTP requests to URLs supplied by smart contracts i…
Check whether web3 is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for web3 CVEs against the assets you own.
Book a Demo →