By vendor

Python-Zeep vulnerabilities

Known CVEs affecting Python-Zeep products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-58501MEDIUM 5.9

  Zeep, a popular Python library for consuming SOAP web services, has a configuration bypass vulnerability affecting versions 4.0.0 through 4.3.2. The library includes a security setting called forbid_external designed to prevent risky automatic fetching of external resources during WSDL and XSD parsing, but this setting is not actually enforced. An attacker can bypass this protection by crafting malicious SOAP schema documents that include references to external XML resources. When a vulnerable application parses these documents, Zeep will automatically fetch attacker-controlled URLs over HTTP or HTTPS without respecting the forbid_external setting, potentially exposing sensitive information or enabling further attacks. The issue is resolved in version 4.3.3.