Skip to content
OpenAdvisories

Vendor

urllib3

13 known vulnerabilities.

Products

urllib3 13
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-97688

    urllib3: Chunked Deflate streaming can enter an infinite loop

    urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeated…

    urllib3 urllib3 python-pip urllib3 Debian Ubuntu PyPI
  • Medium 5.3
    CVE-2025-50182

    urllib3 does not control redirects in browsers and Node.js

    urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling…

    urllib3 urllib3 python-urllib3 urllib3 Debian PyPI
  • Medium 5.3
    CVE-2025-50181

    urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

    urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are …

    urllib3 urllib3 python-pip urllib3 Debian Ubuntu PyPI
  • Medium 4.4
    CVE-2024-37891

    Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3

    urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3'…

    urllib3 urllib3 python-pip urllib3 Debian Ubuntu PyPI
  • Medium 4.2
    CVE-2023-45803

    Request body not stripped after redirect in urllib3

    urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body…

    urllib3 urllib3 python-pip urllib3 Debian Ubuntu Alpine PyPI
  • Medium 5.9
    CVE-2023-43804 Public exploit

    `Cookie` HTTP header isn't stripped on cross-origin redirects

    urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `C…

    urllib3 urllib3 python-pip urllib3 Debian Ubuntu Alpine PyPI