Find real vulnerabilities before they ship
requests-hardened is a library that overrides the default behaviors of the requests library, and adds new security features. Prior to , the SSRF protection in requests-hardened fails to block IP addresses within the RFC 6598 Shared Address Space (100.64.0.0/10). An attacker who can supply arbitrary URLs to requests-hardened could exploit this gap to access internal services hosted within 100.64.0.0/10. This is for example relevant in environments such as AWS EKS where 100.64.0.0/10 is commonly used as the default pod CIDR. The impact is environment-dependent, deployments that utilize the affected CIDR range for internal networking are exposed to SSRF bypass, while others may not be affected. This vulnerability is fixed in .
Base Score
6.5| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| requests-hardened(PyPI) | 0 | 1.2.1 | N/A |
| Base Score | 6.5 |
|---|---|
| Vector String | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N |
| Base Severity | Medium |
| Version | 3.1 |
| Attack Vector (AV) | NETWORK |
