Python Zeep
Approved changes feed: RSS · Atom
cpe:2.3:a:mvantellingen:python-zeep:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Mvantellingen (0c41ed41-f458-5583-87de-9e7889fb6f9c) |
|---|---|
| Product | Python Zeep (97b017f7-a601-509d-b4cb-5b6e402e29ec) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-58501 |
vulnerable | 2026-07-29 01:03:16.878121 |
Zeep SSRF because Settings.forbid_external is not enforced
MEDIUM (5.9)
Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbid_external is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fixed in version 4.3.3.
Published: 2026-07-08T19:31:55.937Z
Updated: 2026-07-09T13:20:46.160Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.