Vulnerabilities for urllib3

First version without a known vulnerability: 2.7.0

Details

• GHSA-mf9v-mfxr-j63j2026-05-11

  urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

  Fixed in: 2.7.0

• GHSA-qccp-gfcp-xxvc2026-05-11

  urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

  Fixed in: 2.7.0

• GHSA-38jv-5279-wg992026-01-07

  Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

  Fixed in: 2.6.3

• GHSA-2xpw-w6gg-jr372025-12-05

  urllib3 streaming API improperly handles highly compressed data

  Fixed in: 2.6.0

• GHSA-gm62-xv2j-4w532025-12-05

  urllib3 allows an unbounded number of links in the decompression chain

  Fixed in: 2.6.0

• GHSA-48p4-8xcf-vxj52025-06-18

  urllib3 does not control redirects in browsers and Node.js

  Fixed in: 2.5.0

• GHSA-pq67-6m6q-mj2v2025-06-18

  urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

  Fixed in: 2.5.0

• GHSA-34jh-p97f-mpxf2024-06-17

  urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects

  Fixed in: 1.26.19, 2.2.2

• GHSA-g4mx-q9vg-27p42023-10-17

  urllib3's request body not stripped after redirect from 303 status changes request method to GET

  Fixed in: 2.0.7, 1.26.18, 4e98d57809dacab1cbe625fddeec1a290c478ea9

• GHSA-gwvm-45gx-3cf82023-10-15

  Authorization Header forwarded on redirect

  Fixed in: 1.24.2, adb358f8e06865406d1f05e581a16cbea2136fbc

• GHSA-v845-jxx5-vc9f2023-10-02

  `Cookie` HTTP header isn't stripped on cross-origin redirects

  Fixed in: 2.0.6, 1.26.17, 644124ecd0b6e417c527191f866daa05a5a2056d, 01220354d389cd05474713f8c982d05c9b17aafb

• GHSA-v4w5-p2hg-8fh62022-05-17

  Urllib3 Incorrect Certificate Validation

  Fixed in: 1.18.1

• GHSA-r64q-w8jr-g9qp2022-05-13

  Improper Neutralization of CRLF Sequences in urllib3 library for Python

  Fixed in: 1.24.3

• GHSA-wqvq-5m8c-6g242021-06-18

  CRLF injection in urllib3

  Fixed in: 1.25.9, 1dd69c5c5982fae7c87a620d487c2ebf7a6b436b

• GHSA-q2q7-5pp4-w6pg2021-06-01

  Catastrophic backtracking in URL authority parser when passed URL containing many @ characters

  Fixed in: 1.26.5, 2d4a3fee6de2fa45eb82169361918f759269b4ec

• GHSA-hmv2-79q8-fv6g2021-04-30

  Uncontrolled Resource Consumption in urllib3

  Fixed in: 1.25.8, a74c9cfbaed9f811e7563cfc3dce894928e0221a

• GHSA-5phf-pp7p-vc2r2021-03-19

  Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection

  Fixed in: 1.26.4, 8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0

• GHSA-mh33-7rrq-662w2019-04-19

  Improper Certificate Validation in urllib3

  Fixed in: 1.24.2

• GHSA-www2-v7xj-xrc62018-12-12

  Exposure of Sensitive Information to an Unauthorized Actor in urllib3

  Fixed in: 1.23