Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-44431: urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | python3-urllib3 | 0:1.25.6-2.amzn2.0.6 |
Vulnerabilities 1
-
High 8.2
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerabili…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-44431.html