Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

urllib3

22 known vulnerabilities (7 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
22 · 7 high, 6 medium
Weekly downloads
380.6M
Dependents
204K
Registry
PyPI

Advisories 22

  • urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

    Affected: from 1.10.3, fixed in 2.8.0.

  • CVE-2026-97688Medium 6.9

    urllib3: Chunked Deflate streaming can enter an infinite loop

    Affected: from 2.6.2, fixed in 2.8.0.

  • urllib3: HTTPS proxy TLS configuration may be ignored or overridden

    Affected: from 1.26.0, fixed in 2.8.0.

  • urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

    Affected: from 1.23, fixed in 2.7.0.

  • urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

    Affected: from 2.6.0, fixed in 2.7.0.

  • urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

    Affected: from 1.22, fixed in 2.6.3.

  • urllib3 Streaming API improperly handles highly compressed data

    Affected: from 1.0, fixed in 2.6.0.

  • urllib3 allows an unbounded number of links in the decompression chain

    Affected: from 1.24, fixed in 2.6.0.

  • CVE-2025-50182Medium 5.3

    urllib3 does not control redirects in browsers and Node.js

    Affected: from 2.2.0, fixed in 2.5.0.

  • CVE-2025-50181Medium 5.3

    urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

    Affected: fixed in 2.5.0.

  • CVE-2024-37891Medium 4.4

    Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3

    Affected: fixed in 1.26.19; from 2.0.0, fixed in 2.2.2; fixed in 1.26.19; from 2.0.0, fixed in 2.2.2.

  • CVE-2023-45803Medium 4.2

    Request body not stripped after redirect in urllib3

    Affected: from 2.0.0, fixed in 2.0.7; fixed in 1.26.18; from 2.0.0, fixed in 2.0.7; fixed in 1.26.18.

  • urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs…

    Affected: fixed in 1.24.2; fixed in 1.24.2.

  • CVE-2023-43804Medium 5.9

    `Cookie` HTTP header isn't stripped on cross-origin redirects

    Affected: from 2.0.0, fixed in 2.0.6; fixed in 1.26.17; from 2.0.0, fixed in 2.0.6; fixed in 1.26.17.

  • An issue was discovered in urllib3 before 1.26.5.

    Affected: from 1.25.4, fixed in 1.26.5.

Show all 22 advisoriesShow fewer advisories

  • The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies.

    Affected: from 1.26.0, fixed in 1.26.4.

  • urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF…

    Affected: fixed in 1.25.9; fixed in 1.25.9.

  • The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU…

    Affected: from 1.25.2, fixed in 1.25.8.

  • The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS…

    Affected: fixed in 1.24.2; fixed in 1.24.2.

  • In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

    Affected: fixed in 1.24.3; fixed in 1.24.3.

  • urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that…

    Affected: fixed in 1.23.

  • Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not…

    Affected: from 1.17, fixed in 1.18.1.