Urllib3 (Python) - vulnerabilities (CVEs)

22 CVEs, 3 in the last 30 days, 107 known versions, newest CVE from 2026-09-29. Vendor: Python.

CVEs of Urllib3

CVE-2026-97689 - CVSS 8.9 (high), 2026-09-29: urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded…
CVE-2026-97688 - CVSS 6.9 (medium), 2026-09-29: urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the…
CVE-2026-97687 - CVSS 8.1 (high), 2026-09-29: urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context,…
CVE-2026-44431 - CVSS 8.2 (high), 2026-05-13: urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via…
CVE-2026-44432 - CVSS 8.9 (high), 2026-05-13: urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1)…
CVE-2026-21441 - CVSS 8.9 (high), 2026-01-07: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in…
CVE-2025-66471 - CVSS 8.9 (high), 2025-12-05: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed…
CVE-2025-66418 - CVSS 8.9 (high), 2025-12-05: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was…
CVE-2025-50182 - CVSS 6.1 (medium), 2025-06-19: urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and…
CVE-2025-50181 - CVSS 6.1 (medium), 2025-06-19: urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager…
CVE-2024-37891 - CVSS 6.5 (medium), 2024-06-17: urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only…
CVE-2023-45803 - CVSS 4.2 (medium), 2023-10-17: urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using…
CVE-2018-25091 - CVSS 6.1 (medium), 2023-10-15: urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or…
CVE-2023-43804 - CVSS 8.1 (high), 2023-10-04: urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies…
CVE-2021-33503 - CVSS 7.5 (high), 2021-06-29: An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular…
CVE-2021-28363 - CVSS 6.5 (medium), 2021-03-15: The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to…
CVE-2020-26137 - CVSS 6.5 (medium), 2020-09-30: urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the…
CVE-2020-7212 - CVSS 7.5 (high), 2020-03-06: The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because…
CVE-2019-11324 - CVSS 7.5 (high), 2019-04-18: The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA…
CVE-2019-11236 - CVSS 6.1 (medium), 2019-04-15: In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
CVE-2018-20060 - CVSS 9.8 (critical), 2018-12-11: urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port,…
CVE-2016-9015 - CVSS 3.7 (low), 2017-01-11: Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS…