Web3.py versions 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 allow a malicious contract to return an OffchainLookup URL that includes an IPv4‑mapped IPv6 host or AAAA record. Because the library’s _check_ip_blocked() routine does not unwrap these addresses during CCIP Read URL validation, the client can be tricked into issuing HTTP requests to loopback, private, or link‑local services. This flaw allows the client to send requests to internal addresses that it normally would filter out. It is inferred that such unintended connections could expose internal resources to an attacker. The flaw is a typical server‑side request forgery (CWE‑918).

Web3.py versions 7.15.0 through 7.16.0 inclusive, and the pre‑release builds 8.0.0b2 through 8.0.0 are affected. The vulnerability occurs when the CCIP Read feature is enabled and the client processes an OffchainLookup URL provided by a smart contract.

The vulnerability carries a CVSS score of 6.3, indicating moderate severity, while the EPSS score is below 1%, suggesting that exploitation attempts are currently rare. It is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious contract that the client interacts with; the attack is performed from the client side but results in outbound traffic from the client to an arbitrary internal endpoint. The attack vector is therefore a server‑side request forgery triggered by a third‑party contract.