web3 vulnerabilities (PyPI)

2 vulnerabilities.

• web3 PyPI web3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling CVE-2026-40072 Public exploitFix available 1.7 LowApril 4, 2026
• web3 PyPI Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass CVE-2026-111171 Fix available 6.3 MediumApril 4, 2026