Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

zeep

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.9PyPIAmendedPublished

    Zeep: Server-Side Request Forgery (SSRF)

    CVE-2026-58501 · GHSA-4cc2-g9w2-fhf6

    Affected
    • PyPI zeep >= 4.0.0, < 4.3.3
    Fixed in
    4.3.3· Vendor fix available
    Issue
    When parsing a WSDL or XSD document, python-zeep follows transitive references — xsd:import, xsd:include, wsdl:import, and lxml entity/DTD resolution — and will fetch http/https URLs found in those references. The Settings.forbidexternal option, intended to disable this transitive remote fetching, was defined but not wired to any logic from version 4.0.0 through 4.3.2 (a regression introduced when zeep moved off defusedxml in 4.0). As a result, setting forbidexternal=True had no effect, and applications that processed untrusted or attacker-influenced WSDL/XSD documents could be coerced into making server-side requests to arbitrary URLs (SSRF). Impact Server-Side Request Forgery (SSRF), CWE-918. An attacker who can supply or influence the contents of a WSDL/XSD that an application loads with zeep can embed an import/include reference (e.g. <xsd:import schemaLocation="http://169.254.169.254/...") pointing at an internal or otherwise sensitive endpoint. When zeep parses the…

    Recommended action: Upgrade to 4.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →