# urllib3 (PyPI) vulnerabilities 22 known vulnerabilities (7 high, 6 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.8.0 (Sep 15, 2026): no advisory affects it - Newest unaffected release: 2.8.0 (Sep 15, 2026), the latest release - Weekly downloads: 380.6M - Dependents: 204K - Releases: 105 since 0.3.0 - Registry: https://pypi.org/project/urllib3/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-97689: 1.10.3 to 2.7.0 (2.8.0 is outside it) - CVE-2026-97688: 2.6.2 to 2.7.0 (2.8.0 is outside it) - CVE-2026-97687: 1.26.0 to 2.7.0 (2.8.0 is outside it) - CVE-2026-44431: 1.23.0 to 2.6.3 (2.7.0 is outside it) - CVE-2026-44432: 2.6.0 to 2.6.3 (2.7.0 is outside it) - CVE-2026-21441: 1.22.0 to 2.6.2 (2.6.3 is outside it) - CVE-2025-66471: 1.0.0 to 2.5.0 (2.6.0 is outside it) - CVE-2025-66418: 1.24.0 to 2.5.0 (2.6.0 is outside it) - CVE-2025-50182: 2.2.0 to 2.4.0 (2.5.0 is outside it) - CVE-2025-50181: 0.3.0 to 2.4.0 (2.5.0 is outside it) - CVE-2024-37891: 0.3.0 to 1.26.18 (1.26.19 is outside it); 2.0.0 to 2.2.1 (2.2.2 is outside it) - CVE-2023-45803: 0.3.0 to 1.26.17 (1.26.18 is outside it); 2.0.0 to 2.0.6 (2.0.7 is outside it) - CVE-2018-25091: 0.3.0 to 1.24.1 (1.24.2 is outside it) - CVE-2023-43804: 0.3.0 to 1.26.16 (1.26.17 is outside it); 2.0.0 to 2.0.5 (2.0.6 is outside it) - CVE-2021-33503: 1.25.4 to 1.26.4 (1.26.5 is outside it) - CVE-2021-28363: 1.26.0 to 1.26.3 (1.26.4 is outside it) - CVE-2020-26137: 0.3.0 to 1.25.8 (1.25.9 is outside it) - CVE-2020-7212: 1.25.2 to 1.25.7 (1.25.8 is outside it) - CVE-2019-11324: 0.3.0 to 1.24.1 (1.24.2 is outside it) - CVE-2019-11236: 0.3.0 to 1.24.2 (1.24.3 is outside it) - CVE-2018-20060: 0.3.0 to 1.22.0 (1.23.0 is outside it) - CVE-2016-9015: 1.17.0 to 1.18.0 (1.18.1 is outside it) ## Advisories (22) ### [CVE-2026-97689](https://cve.now/CVE-2026-97689): urllib3: HTTPResponse.stream()/read\_chunked() buffers an unbounded chunk-size line into memory - Severity: High 8.9 - Published: Sep 29, 2026 - Affected: from 1.10.3, fixed in 2.8.0. - Fixed in 2.8.0 (released Sep 15, 2026, 14 days before disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2026-97688](https://cve.now/CVE-2026-97688): urllib3: Chunked Deflate streaming can enter an infinite loop - Severity: Medium 6.9 - Published: Sep 29, 2026 - Affected: from 2.6.2, fixed in 2.8.0. - Fixed in 2.8.0 (released Sep 15, 2026, 14 days before disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2026-97687](https://cve.now/CVE-2026-97687): urllib3: HTTPS proxy TLS configuration may be ignored or overridden - Severity: High 7.6 - Published: Sep 29, 2026 - Affected: from 1.26.0, fixed in 2.8.0. - Fixed in 2.8.0 (released Sep 15, 2026, 14 days before disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2026-44431](https://cve.now/CVE-2026-44431): urllib3: Sensitive headers forwarded across origins in proxied low-level redirects - Severity: High 8.2 - Published: May 13, 2026 - Affected: from 1.23, fixed in 2.7.0. - Fixed in 2.7.0 (released May 7, 2026, 6 days before disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2026-44432](https://cve.now/CVE-2026-44432): urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API - Severity: High 8.9 - Published: May 13, 2026 - Affected: from 2.6.0, fixed in 2.7.0. - Fixed in 2.7.0 (released May 7, 2026, 6 days before disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2026-21441](https://cve.now/CVE-2026-21441): urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) - Severity: High 8.9 - Published: Jan 7, 2026 - Affected: from 1.22, fixed in 2.6.3. - Fixed in 2.6.3 (released Jan 7, 2026, the day of disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2025-66471](https://cve.now/CVE-2025-66471): urllib3 Streaming API improperly handles highly compressed data - Severity: High 8.9 - Published: Dec 5, 2025 - Affected: from 1.0, fixed in 2.6.0. - Fixed in 2.6.0 (released Dec 5, 2025, the day of disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2025-66418](https://cve.now/CVE-2025-66418): urllib3 allows an unbounded number of links in the decompression chain - Severity: High 8.9 - Published: Dec 5, 2025 - Affected: from 1.24, fixed in 2.6.0. - Fixed in 2.6.0 (released Dec 5, 2025, the day of disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2025-50182](https://cve.now/CVE-2025-50182): urllib3 does not control redirects in browsers and Node.js - Severity: Medium 5.3 - Published: Jun 19, 2025 - Affected: from 2.2.0, fixed in 2.5.0. - Fixed in 2.5.0 (released Jun 18, 2025, 1 day before disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2025-50181](https://cve.now/CVE-2025-50181): urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation - Severity: Medium 5.3 - Published: Jun 19, 2025 - Affected: fixed in 2.5.0. - Fixed in 2.5.0 (released Jun 18, 2025, 1 day before disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2024-37891](https://cve.now/CVE-2024-37891): Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3 - Severity: Medium 4.4 - Published: Jun 17, 2024 - Affected: fixed in 1.26.19; from 2.0.0, fixed in 2.2.2; fixed in 1.26.19; from 2.0.0, fixed in 2.2.2. - Fixed in 1.26.19 (released Jun 17, 2024, the day of disclosure) and 2.2.2 (released Jun 17, 2024, the day of disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2023-45803](https://cve.now/CVE-2023-45803): Request body not stripped after redirect in urllib3 - Severity: Medium 4.2 - Published: Oct 17, 2023 - Affected: from 2.0.0, fixed in 2.0.7; fixed in 1.26.18; from 2.0.0, fixed in 2.0.7; fixed in 1.26.18. - Fixed in 1.26.18 (released Oct 17, 2023, the day of disclosure) and 2.0.7 (released Oct 17, 2023, the day of disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2018-25091](https://cve.now/CVE-2018-25091): urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs… - Severity: Unrated - Published: Oct 15, 2023 - Affected: fixed in 1.24.2; fixed in 1.24.2. - Fixed in 1.24.2 (released Apr 17, 2019, 1642 days before disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2023-43804](https://cve.now/CVE-2023-43804): \`Cookie\` HTTP header isn't stripped on cross-origin redirects - Severity: Medium 5.9 - Published: Oct 4, 2023 - Affected: from 2.0.0, fixed in 2.0.6; fixed in 1.26.17; from 2.0.0, fixed in 2.0.6; fixed in 1.26.17. - Fixed in 1.26.17 (released Oct 2, 2023, 2 days before disclosure) and 2.0.6 (released Oct 2, 2023, 2 days before disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2021-33503](https://cve.now/CVE-2021-33503): An issue was discovered in urllib3 before 1.26.5. - Severity: Unrated - Published: Jun 29, 2021 - Affected: from 1.25.4, fixed in 1.26.5. - Fixed in 1.26.5 (released May 26, 2021, 34 days before disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2021-28363](https://cve.now/CVE-2021-28363): The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. - Severity: Unrated - Published: Mar 15, 2021 - Affected: from 1.26.0, fixed in 1.26.4. - Fixed in 1.26.4 (released Mar 15, 2021, the day of disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2020-26137](https://cve.now/CVE-2020-26137): urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF… - Severity: Unrated - Published: Sep 29, 2020 - Affected: fixed in 1.25.9; fixed in 1.25.9. - Fixed in 1.25.9 (released Apr 16, 2020, 166 days before disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2020-7212](https://cve.now/CVE-2020-7212): The \_encode\_invalid\_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU… - Severity: Unrated - Published: Mar 6, 2020 - Affected: from 1.25.2, fixed in 1.25.8. - Fixed in 1.25.8 (released Jan 21, 2020, 45 days before disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2019-11324](https://cve.now/CVE-2019-11324): The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS… - Severity: Unrated - Published: Apr 18, 2019 - Affected: fixed in 1.24.2; fixed in 1.24.2. - Fixed in 1.24.2 (released Apr 17, 2019, 1 day before disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2019-11236](https://cve.now/CVE-2019-11236): In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. - Severity: Unrated - Published: Apr 15, 2019 - Affected: fixed in 1.24.3; fixed in 1.24.3. - Fixed in 1.24.3 (released May 2, 2019, 17 days after disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2018-20060](https://cve.now/CVE-2018-20060): urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that… - Severity: Unrated - Published: Dec 11, 2018 - Affected: fixed in 1.23. - Fixed in 1.23.0 (released Jun 5, 2018, 189 days before disclosure). - The latest release, 2.8.0, is not affected. ### [CVE-2016-9015](https://cve.now/CVE-2016-9015): Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not… - Severity: Unrated - Published: Jan 11, 2017 - Affected: from 1.17, fixed in 1.18.1. - Fixed in 1.18.1 (released Oct 27, 2016, 76 days before disclosure). - The latest release, 2.8.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/urllib3 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.