CVE-2025-68616
published 2026-01-19CVE-2025-68616: WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's…
PriorityP349high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.50%
40.1th percentile
WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a custom `url_fetcher` to block such access. This occurs because the underlying `urllib` library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kozea | weasyprint | < 68.0 | 68.0 |
| kozea | weasyprint | >= 0 < 68.0 | 68.0 |
| lexiforest | curl_cffi | >= 0 < 0.15.0 | 0.15.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
ghsa7.5HIGH
osv7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
osv·2026-04-03·CVSS 7.5
CVE-2026-33752 [HIGH] curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
### Summary
curl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl.
Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls.
### Details
The issue comes from how curl_cffi handles outbound requests
- User-supplied URLs are passed directly to libcurl without checking whether they resolve to internal IP ranges (e.g., 127.0.0.1, 169.254.0.0/16).
- Redirects are automatically followed (CURLOPT_FOLLOWL
GHSA
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
ghsa·2026-04-03·CVSS 7.5
CVE-2026-33752 [HIGH] CWE-918 curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
### Summary
curl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl.
Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls.
### Details
The issue comes from how curl_cffi handles outbound requests
- User-supplied URLs are passed directly to libcurl without checking whether they resolve to internal IP ranges (e.g., 127.0.0.1, 169.254.0.0/16).
- Redirects are automatically followed (CURLOPT_FOLLOWL
GHSA
WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect
ghsa·2026-01-20
CVE-2025-68616 [HIGH] CWE-601 WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect
WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect
### Summary
A **Server-Side Request Forgery (SSRF) Protection Bypass** exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a custom `url_fetcher` to block such access. This occurs because the underlying `urllib` library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy.
### Details
The default URL fetching mechanism in WeasyPrint (default_url_fetcher in weasyprint/urls.py) is vulnerable to a Server-Side Request Forgery (SSRF) Protection Bypass.
While WeasyPrint allows de
OSV
WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect
osv·2026-01-20
CVE-2025-68616 [HIGH] WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect
WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect
### Summary
A **Server-Side Request Forgery (SSRF) Protection Bypass** exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a custom `url_fetcher` to block such access. This occurs because the underlying `urllib` library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy.
### Details
The default URL fetching mechanism in WeasyPrint (default_url_fetcher in weasyprint/urls.py) is vulnerable to a Server-Side Request Forgery (SSRF) Protection Bypass.
While WeasyPrint allows de
Red Hat
WeasyPrint: WeasyPrint Server-Side Request Forgery (SSRF)
vendor_redhat·2026-01-19·CVSS 7.5
CVE-2025-68616 [HIGH] CWE-918 WeasyPrint: WeasyPrint Server-Side Request Forgery (SSRF)
WeasyPrint: WeasyPrint Server-Side Request Forgery (SSRF)
WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a custom `url_fetcher` to block such access. This occurs because the underlying `urllib` library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.
A Server-Side Request Forgery (SSRF) Protection Bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows at
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-68616 weasyprint: WeasyPrint Server-Side Request Forgery (SSRF) [fedora-42]
bugzilla·2026-01-19·CVSS 7.5
CVE-2025-68616 [HIGH] CVE-2025-68616 weasyprint: WeasyPrint Server-Side Request Forgery (SSRF) [fedora-42]
CVE-2025-68616 weasyprint: WeasyPrint Server-Side Request Forgery (SSRF) [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, change the '
Bugzilla
CVE-2025-68616 WeasyPrint: WeasyPrint Server-Side Request Forgery (SSRF)
bugzilla·2026-01-19·CVSS 7.5
CVE-2025-68616 [HIGH] CVE-2025-68616 WeasyPrint: WeasyPrint Server-Side Request Forgery (SSRF)
CVE-2025-68616 WeasyPrint: WeasyPrint Server-Side Request Forgery (SSRF)
WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a custom `url_fetcher` to block such access. This occurs because the underlying `urllib` library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.
Wiz
CVE-2025-68616 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2025-68616 [HIGH] CVE-2025-68616 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-68616 :
Python vulnerability analysis and mitigation
default_url_fetcher
localhost
url_fetcher
urllib
Source : NVD
## 7.5
Score
Published January 19, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
Python
Homebrew
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 18.9
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
python3-tinycss2
python3-weasyprint
Sources
NVD
Alpine 3.14, 3.15, 3.16, 3.17, 3.18, 3.19, 3.20, 3.21, 3.22, 3.23, edge Severity HIGH No Fix Added at: Feb 19, 2026
pip Severity HIGH Has Fix Added at: Jan 21, 2026
Homebrew Severity HIGH Has Fix Added at: Feb 20, 2026
## Get a CVE risk assessment
Get a prioritized view of
https://github.com/Kozea/WeasyPrint/commit/b6a14f0f3f4ce9c0c75c1a2d73cb1c5d43f0e565https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-983w-rhvv-gwmvhttps://access.redhat.com/security/cve/CVE-2025-68616https://bugzilla.redhat.com/show_bug.cgi?id=2430858https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-983w-rhvv-gwmvhttps://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68616.json
2026-01-19
Published