Description
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-urllib3 | 1.26.4-1 | — |
| Debian 13 | python-urllib3 | 1.26.4-1 | — |
| Debian 12 | python-urllib3 | 1.26.4-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | python-urllib3 +1 | 1:1.24.3-2.el7 | RHBA-2021:1147 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-urllib3 | 1.26.4-r0 | — |
| Alpine v3.23 | py3-urllib3 | 1.26.4-r0 | — |
| Alpine v3.22 | py3-urllib3 | 1.26.4-r0 | — |
| Alpine v3.21 | py3-urllib3 | 1.26.4-r0 | — |
| Alpine v3.20 | py3-urllib3 | 1.26.4-r0 | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | py3-urllib3 | 1.26.4-r0 | — |
| Alpine v3.18 | py3-urllib3 | 1.26.4-r0 | — |
| Alpine v3.17 | py3-urllib3 | 1.26.4-r0 | — |
| Alpine v3.16 | py3-urllib3 | 1.26.4-r0 | — |
| Alpine v3.15 | py3-urllib3 | 1.26.4-r0 | — |
| Alpine v3.14 | py3-urllib3 | 1.26.4-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | python2-pip +2 | 20.2.2-1.amzn2.0.3 | ALAS2-2021-1667 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | urllib3 | >= 1.26.0, < 1.26.4 | 1.26.4 | GHSA-5phf-pp7p-vc2r |
Advisories 4
- RHBA-2021:1147 Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11.420 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
- ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
- ALAS2-2021-1667 Moderate: python-pip security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 7, 2025
References
- https://github.com/urllib3/urllib3/commits/main
- FEDORA-2021-3f378dda90 vendor-advisory
- GLSA-202107-36 vendor-advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://pypi.org/project/urllib3/1.26.4/
- https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0
- https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r
- GLSA-202305-02 vendor-advisory
- https://security.netapp.com/advisory/ntap-20240621-0007/