What is the CVSS score of CVE-2026-42175?

CVE-2026-42175 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-42175?

Yes, a patch is available for CVE-2026-42175. Update the affected software to the latest version immediately.

requests-hardened CVE-2026-42175

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-05 https://github.com/saleor/requests-hardened

GHSA-vh75-fwv3-pqrh

Python SSRF

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 05, 2026 - 20:33 vuln.today

Analysis Generated

May 05, 2026 - 20:33 vuln.today

DescriptionGitHub Advisory

The SSRF protection in requests-hardened prior to version 1.2.1 fails to block IP addresses within the RFC 6598 Shared Address Space (100.64.0.0/10). An attacker who can supply arbitrary URLs to requests-hardened could exploit this gap to access internal services hosted within 100.64.0.0/10. This is for example relevant in environments such as AWS EKS where 100.64.0.0/10 is commonly used as the default pod CIDR.

The impact is environment-dependent, deployments that utilize the affected CIDR range for internal networking are exposed to SSRF bypass, while others may not be affected.

The issue is resolved in version 1.2.1 by extending the IP filtering logic to explicitly block the RFC 6598 range in addition to standard private addresses, as well as blocking all other reserved addresses (such as multicast) to prevent the re-occurrence of similar issues.

Version 1.2.1 is now blocking the following CIDRs:

192.88.99.0/24 - 6to4 relay anycast
100.64.0.0/10 - CG-NAT
5f00::/16 - IPv6 Segment Routing
64:ff9b::/96 - used for IPv6 & IPv4 translation (NAT64)
2001:20::/28 - ORCHIDv2 (overlay identifiers)
224.0.0.0/4 - multicast
ff00::/8 - multicast

Resources

https://github.com/python/cpython/issues/119812
https://github.com/saleor/requests-hardened/commit/b7403f88d3b3689e57435b75b51691a160aaeef5 - the fix itself
https://github.com/saleor/requests-hardened/commit/a266b3958bb142bca515b3c230fdea19fbda327c - follow up, adding additional support for outdated Python versions (3.11.9 and 3.10.11 instead of only 3.11.15 and 3.10.20)
https://github.com/saleor/requests-hardened/releases/tag/v1.2.1

AnalysisAI

Server-side request forgery in requests-hardened prior to 1.2.1 allows remote attackers to bypass SSRF protection and access internal services within RFC 6598 Shared Address Space (100.64.0.0/10) by supplying arbitrary URLs, particularly impacting AWS EKS deployments where this CIDR is the default pod network. The vulnerability has a CVSS score of 6.5 and is environment-dependent, affecting only deployments using the vulnerable IP range for internal networking. Vendor-released patch: version 1.2.1 extends IP filtering logic to block RFC 6598, 6to4 relay anycast, IPv6 reserved ranges, and multicast addresses.

Technical ContextAI

requests-hardened is a Python library (pkg:pip/requests-hardened) that wraps the requests HTTP library with SSRF protection by filtering outbound requests to internal IP ranges. The vulnerability stems from incomplete IP range validation in the ip_filter.py module (CWE-918: Server-Side Request Forgery). The SSRF protection mechanism should block requests to reserved, private, and link-local IP ranges to prevent attackers from pivoting through a trusted HTTP client to access internal infrastructure. Prior to version 1.2.1, the filtering logic failed to account for RFC 6598 Carrier-Grade NAT (CG-NAT) address space (100.64.0.0/10), which is commonly allocated in containerized environments like AWS EKS for pod-to-pod communication. The fix adds explicit blocking of seven additional CIDR ranges: 192.88.99.0/24, 100.64.0.0/10, 5f00::/16, 64:ff9b::/96, 2001:20::/28, 224.0.0.0/4, and ff00::/8, as well as backfilling support for outdated Python versions 3.10.11 and 3.11.9 that lack proper ipaddress module coverage.

RemediationAI

Vendor-released patch: upgrade requests-hardened to version 1.2.1 or later immediately. For Python 3.10 and 3.11 users, ensure the patched version is installed from https://github.com/saleor/requests-hardened/releases/tag/v1.2.1, which includes backports for Python 3.10.11 and 3.11.9 via commit a266b3958bb142bca515b3c230fdea19fbda327c. If immediate patching is not feasible, implement network-level controls by blocking outbound HTTP/HTTPS requests from application servers to the 100.64.0.0/10 range using firewall rules or network policies (in Kubernetes, use NetworkPolicy to deny traffic to 100.64.0.0/10). This mitigates the specific SSRF gap but does not address other reserved ranges now blocked in 1.2.1, and requires ongoing manual maintenance. Additionally, validate and sanitize all user-supplied URLs in the application layer before passing them to requests-hardened, restricting to allowlisted domains where feasible. This eliminates reliance on requests-hardened as the sole security boundary. See https://github.com/saleor/requests-hardened/security/advisories/GHSA-vh75-fwv3-pqrh for the full advisory.