EUVD-2026-42353Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
SSRF inherently changes scope as the server fetches attacker-chosen external URLs; AC:H because attacker must control WSDL/XSD content reaching the parser.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2Blast Radius
ecosystem impact- 7 pypi packages depend on zeep (7 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.0.0.
DescriptionCVE.org
Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbid_external is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fixed in version 4.3.3.
AnalysisAI
Server-Side Request Forgery in Python Zeep 4.0.0 through 4.3.2 allows an attacker who can influence WSDL or XSD content parsed by the library to bypass the explicit Settings.forbid_external security control, causing the server to issue HTTP or HTTPS requests to attacker-chosen URLs via transitive xsd:import, xsd:include, wsdl:import, or lxml entity and DTD references. The vulnerability is particularly significant because it defeats a documented security setting that developers actively configure to prevent external fetching - applications relying on this control are silently unprotected. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Technical ContextAI
Python Zeep (CPE: cpe:2.3:a:mvantellingen:python-zeep) is a widely used Python SOAP client library that processes WSDL (Web Services Description Language) and XSD (XML Schema Definition) documents to generate service bindings. WSDL and XSD documents support transitive resource inclusion via xsd:import, xsd:include, and wsdl:import directives, and the underlying lxml XML parsing library additionally supports entity and DTD references that can resolve external URLs. The library exposes a Settings.forbid_external configuration flag intended to block all such external fetches during document parsing. The root cause (CWE-918, Server-Side Request Forgery) is that this flag is defined in the settings model but never evaluated in the actual import/include resolution code paths, meaning the control has zero enforcement. An attacker embedding a reference to an attacker-controlled or internal URL in any of these directive types will cause the Zeep client process to initiate an outbound HTTP or HTTPS request regardless of the setting value.
RemediationAI
Upgrade to Python Zeep version 4.3.3 or later, which is the vendor-confirmed fix per the GitHub release at https://github.com/mvantellingen/python-zeep/releases/tag/4.3.3 and associated commit https://github.com/mvantellingen/python-zeep/commit/83eb07bc6c84d841329d4f88856fecdba86f753e. The full advisory is at https://github.com/mvantellingen/python-zeep/security/advisories/GHSA-4cc2-g9w2-fhf6. If an immediate upgrade is not possible, as a compensating control restrict outbound HTTP/HTTPS access from the application process using network egress filtering or host-based firewall rules to allow only the specific SOAP service endpoints the application legitimately communicates with - this limits SSRF reach even if the bypass remains present. Additionally, avoid accepting user-supplied or externally-sourced WSDL URLs at the application layer; pin WSDL locations to trusted, internally hosted copies. Note that neither workaround restores the intended behavior of forbid_external; upgrading to 4.3.3 is the only complete fix.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today