Description
urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stripping the HTTP request body.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| urllib3 | urllib3 | >= 2.0.0, < 2.0.7, < 1.26.18 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-urllib3 | 1.26.18-1 | — |
| Debian 13 | python-urllib3 | 1.26.18-1 | — |
| Debian 12 | python-urllib3 | 1.26.12-1+deb12u1 | — |
| Debian 11 | python-urllib3 | 1.26.5-1~exp1+deb11u1 | DLA-3998-1 |
| Debian 10 | python-urllib3 | 1.24.1-1+deb10u2 | DLA-3649-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | python-pip | 24.0+dfsg-1ubuntu1.3 | USN-7762-1 |
| Ubuntu 22.04 LTS | python-pip | 22.0.2+dfsg-1ubuntu0.4 | USN-7762-1, USN-6473-2 |
| Ubuntu 22.04 LTS | python-urllib3 | 1.26.5-1~exp1ubuntu0.1 | USN-6473-1 |
| Ubuntu 20.04 LTS | python-pip | 20.0.2-5ubuntu1.10 | USN-6473-2 |
| Ubuntu 20.04 LTS | python-urllib3 | 1.25.8-2ubuntu0.3 | USN-6473-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | python-pip | 9.0.1-2.3~ubuntu1.18.04.8+esm2 | USN-6473-2 |
| Ubuntu Pro 18.04 LTS | python-urllib3 | 1.22-1ubuntu0.18.04.2+esm1 | USN-6473-1 |
| Ubuntu Pro 16.04 LTS | python-pip | 8.1.1-2ubuntu0.6+esm6 | USN-6473-2 |
| Ubuntu Pro 16.04 LTS | python-urllib3 | 1.13.1-2ubuntu0.16.04.4+esm1 | USN-6473-1 |
| Ubuntu Pro 14.04 LTS | python-pip +1 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | fence-virt +55 | 4.10.0-55.el9_3.3 | RHSA-2024:2132, RHBA-2024:1137 |
| RHEL 9 | python-urllib3 +1 | 1.26.5-3.el9_3.1 | RHSA-2024:0464 |
| RHEL 9 | python3.11-urllib3 | 1.26.12-2.el9_5.2 | RHSA-2024:11238 |
| RHEL 8 | aardvark-dns | 2:1.10.0-1.module+el8.10.0+21209+52deeb51 | RHSA-2024:2988 |
| RHEL 8 | buildah +1 | 2:1.33.6-2.module+el8.10.0+21371+46937ece | RHSA-2024:2988 |
| RHEL 8 | cockpit-podman | 84.1-1.module+el8.10.0+21373+0d273fdf | RHSA-2024:2988 |
| RHEL 8 | conmon | 3:2.1.10-1.module+el8.10.0+21077+98b84d8a | RHSA-2024:2988 |
| RHEL 8 | container-selinux | 2:2.229.0-2.module+el8.10.0+21196+3f0abbca | RHSA-2024:2988 |
| RHEL 8 | containernetworking-plugins | 1:1.4.0-2.module+el8.10.0+21366+f9cb49f8 | RHSA-2024:2988 |
| RHEL 8 | containers-common | 2:1-81.module+el8.10.0+21340+c6c7475a | RHSA-2024:2988 |
| RHEL 8 | crit +4 | 3.18-4.module+el8.9.0+20326+387084d0 | RHSA-2024:2988 |
| RHEL 8 | crun | 1.14.3-2.module+el8.10.0+21340+c6c7475a | RHSA-2024:2988 |
| RHEL 8 | fence-agents +47 | 4.2.1-129.el8 | RHSA-2024:2968 |
| RHEL 8 | fuse-overlayfs | 1.13-1.module+el8.10.0+20412+95ee28e2 | RHSA-2024:2988 |
| RHEL 8 | libslirp +1 | 4.4.0-1.module+el8.9.0+20326+387084d0 | RHSA-2024:2988 |
| RHEL 8 | netavark | 2:1.10.3-1.module+el8.10.0+21306+6be40ce7 | RHSA-2024:2988 |
| RHEL 8 | oci-seccomp-bpf-hook | 1.2.10-1.module+el8.10.0+20565+a40ba0e5 | RHSA-2024:2988 |
| RHEL 8 | podman +6 | 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1 | RHSA-2024:2988 |
| RHEL 8 | python-podman +1 | 4.9.0-1.module+el8.10.0+21196+3f0abbca | RHSA-2024:2988 |
| RHEL 8 | python-urllib3 +1 | 1.24.2-5.el8_9.2 | RHSA-2024:0116 |
| RHEL 8 | python3.11-urllib3 | 1.26.12-5.el8_10 | RHSA-2024:11189 |
| RHEL 8 | resource-agents +3 | 4.9.0-54.el8 | RHSA-2024:2952 |
| RHEL 8 | runc | 1:1.1.12-1.module+el8.10.0+21251+62b7388c | RHSA-2024:2988 |
| RHEL 8 | skopeo +1 | 2:1.14.3-0.1.module+el8.10.0+21251+62b7388c | RHSA-2024:2988 |
| RHEL 8 | slirp4netns | 1.2.3-1.module+el8.10.0+21306+6be40ce7 | RHSA-2024:2988 |
| RHEL 8 | toolbox +1 | 0.0.99.5-2.module+el8.10.0+21341+ff0b5f89 | RHSA-2024:2988 |
| RHEL 8 | udica | 0.2.6-20.module+el8.9.0+20326+387084d0 | RHSA-2024:2988 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.7.0.10-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite Utils 6 | satellite +1 | 6.14.1-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | createrepo_c +3 | 1.0.2-2.el8pc | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | foreman +1 | 3.7.0.10-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | foreman-installer +1 | 1:3.7.0.5-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | pulpcore-selinux | 2.0.0-1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | python-django-import-export +1 | 3.1.0-1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | python-gitpython +1 | 3.1.40-0.1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | python-pulp-rpm +1 | 3.19.11-2.el8pc | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | python-pulpcore +1 | 3.22.19-1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | python-urllib3 +1 | 1.26.18-0.1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_remote_execution_ssh | 0.10.2-2.el8sat | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | satellite +2 | 6.14.1-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite 6 | createrepo_c +3 | 1.0.2-2.el8pc | RHSA-2023:7851 |
| Red Hat Satellite 6 | foreman +13 | 3.7.0.10-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite 6 | foreman-installer +1 | 1:3.7.0.5-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite 6 | pulpcore-selinux | 2.0.0-1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite 6 | python-django-import-export +1 | 3.1.0-1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite 6 | python-gitpython +1 | 3.1.40-0.1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite 6 | python-pulp-rpm +1 | 3.19.11-2.el8pc | RHSA-2023:7851 |
| Red Hat Satellite 6 | python-pulpcore +1 | 3.22.19-1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite 6 | python-urllib3 +1 | 1.26.18-0.1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite 6 | rubygem-foreman_leapp | 1.1.0-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite 6 | rubygem-foreman_remote_execution +1 | 10.1.2-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite 6 | rubygem-katello | 4.9.0.18-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite 6 | rubygem-rails +12 | 6.1.7.4-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite 6 | rubygem-smart_proxy_remote_execution_ssh | 0.10.2-2.el8sat | RHSA-2023:7851 |
| Red Hat Satellite 6 | satellite +2 | 6.14.1-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite 6 | satellite-convert2rhel-toolkit | 1.0.0-1.el8sat | RHSA-2023:7851 |
| RHEL 9.4 EUS | python3.11-urllib3 | 1.26.12-2.el9_4.2 | RHSA-2025:1793 |
| RHEL 9.2 EUS | fence-virt +55 | 4.10.0-43.el9_2.3 | RHBA-2024:1091 |
| RHEL 9.2 EUS | python3.11-urllib3 | 1.26.12-1.el9_2.1 | RHSA-2025:1813 |
| RHEL 9.0 EUS | fence-virt +56 | 4.10.0-20.el9_0.11 | RHSA-2024:1155 |
| RHEL 8.8 EUS | python-urllib3 +1 | 1.24.2-5.el8_8.1 | RHSA-2024:0588 |
| RHEL 8.8 EUS | python3.11-urllib3 | 1.26.12-1.el8_8.2 | RHSA-2025:0078 |
| RHEL 8.8 EUS | resource-agents +3 | 4.9.0-40.el8_8.2 | RHBA-2024:1420 |
| RHEL 8.6 EUS | fence-agents +46 | 4.2.1-89.el8_6.11 | RHBA-2024:1114 |
| RHEL 8.6 EUS | python-urllib3 +1 | 1.24.2-5.el8_6.1 | RHSA-2024:0300 |
| RHEL 8.4 TUS | fence-agents +45 | 4.2.1-65.el8_4.14 | RHBA-2024:1398 |
| RHEL 8.4 E4S | fence-agents +45 | 4.2.1-65.el8_4.14 | RHBA-2024:1398 |
| RHEL 8.4 AUS | fence-agents +45 | 4.2.1-65.el8_4.14 | RHBA-2024:1398 |
| Red Hat OpenStack 17 | python-urllib3 +1 | 1.25.10-6.el8ost | RHSA-2024:2734 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | fence-virt +54 | 4.10.0-62.el9 | ALSA-2024:2132 |
| AlmaLinux 9 | python3-urllib3 | 1.26.5-3.el9_3.1 | ALSA-2024:0464 |
| AlmaLinux 9 | python3.11-urllib3 | 1.26.12-2.el9_5.2 | ALSA-2024:11238 |
| AlmaLinux 8 | fence-agents-all +46 | 4.2.1-129.el8 | ALSA-2024:2968 |
| AlmaLinux 8 | python3-urllib3 | 1.24.2-5.el8_9.2 | ALSA-2024:0116 |
| AlmaLinux 8 | python3.11-urllib3 | 1.26.12-5.el8_10 | ALSA-2024:11189 |
| AlmaLinux 8 | resource-agents +3 | 4.9.0-54.el8 | ALSA-2024:2952 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | python3.11-urllib3 | 1.26.12-2.el9_5.2 | RLSA-2024:11238 |
| Rocky Linux 8 | aardvark-dns | 2:1.10.0-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | cockpit-podman | 84.1-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | conmon | 3:2.1.10-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | container-selinux | 2:2.229.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | containernetworking-plugins | 1:1.4.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | containers-common | 2:1-81.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | crun | 1.14.3-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | fence-agents | 4.2.1-129.el8 | RLSA-2024:2968 |
| Rocky Linux 8 | fuse-overlayfs | 1.13-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | libslirp | 4.4.0-1.module+el8.9.0+1445+07728297 | RLSA-2024:2988 |
| Rocky Linux 8 | netavark | 2:1.10.3-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | oci-seccomp-bpf-hook | 1.2.10-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | python-podman | 4.9.0-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | python3.11-urllib3 | 1.26.12-5.el8_10 | RLSA-2024:11189 |
| Rocky Linux 8 | resource-agents | 4.9.0-54.el8 | RLSA-2024:2952 |
| Rocky Linux 8 | runc | 1:1.1.12-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | slirp4netns | 1.2.3-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | toolbox | 0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2 | RLSA-2024:2988 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | python-urllib3 | 1.25.10-150300.4.9.1 | SUSE-SU-2023:4467-1 |
| SLES 15 SP4 | python-urllib3 | 1.25.10-150300.4.9.1 | SUSE-SU-2023:4467-1 |
| SLES 12 SP5 | python-urllib3 | 1.25.10-3.37.1 | SUSE-SU-2023:4468-1 |
| SLES 12 | python-urllib3 | 1.25.10-3.37.1 | SUSE-SU-2023:4468-1 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | python-urllib3 | 1.25.10-3.37.1 | SUSE-SU-2023:4468-1 |
| SLE Micro 5.5 | python-urllib3 | 1.25.10-150300.4.9.1 | SUSE-SU-2024:2462-1, SUSE-SU-2023:4467-1 |
| SLE Micro 5.4 | python-urllib3 | 1.25.10-150300.4.9.1 | SUSE-SU-2023:4467-1 |
| SLE Micro 5.3 | python-urllib3 | 1.25.10-150300.4.9.1 | SUSE-SU-2023:4467-1 |
| SLE Micro 5.2 | python-urllib3 | 1.25.10-150300.4.9.1 | SUSE-SU-2023:4467-1 |
| SLE Micro 5.1 | python-urllib3 | 1.25.10-150300.4.9.1 | SUSE-SU-2023:4467-1 |
| SUSE OpenStack Cloud Crowbar 9 | python-urllib3 | 1.23-3.25.1 | SUSE-SU-2023:4352-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-urllib3 | 1.25.10-5.25.1 | SUSE-SU-2023:4356-1 |
| SUSE OpenStack Cloud 9 | python-urllib3 | 1.23-3.25.1 | SUSE-SU-2023:4352-1 |
| SUSE OpenStack Cloud 8 | python-urllib3 | 1.25.10-5.25.1 | SUSE-SU-2023:4356-1 |
| SUSE Manager Server 4.2 | python-urllib3 | 1.25.10-150300.4.9.1 | SUSE-SU-2023:4467-1 |
| SUSE Manager Proxy 4.2 | python-urllib3 | 1.25.10-150300.4.9.1 | SUSE-SU-2023:4467-1 |
| SUSE HPE Helion OpenStack 8 | python-urllib3 | 1.25.10-5.25.1 | SUSE-SU-2023:4356-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-urllib3 | 2.0.7-1.1 | openSUSE-SU-2026:12044-1, openSUSE-SU-2024:13343-1 |
| openSUSE Tumbleweed | python-urllib3_1 | 1.26.20-7.2 | openSUSE-SU-2026:12045-1 |
| openSUSE Leap 15.5 | python-urllib3 | 1.25.10-150300.4.9.1 | SUSE-SU-2023:4467-1 |
| openSUSE Leap 15.4 | python-urllib3 | 1.25.10-150300.4.9.1 | SUSE-SU-2023:4467-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.4 | python-urllib3 | 1.25.10-150300.4.9.1 | SUSE-SU-2023:4467-1 |
| openSUSE Leap Micro 5.3 | python-urllib3 | 1.25.10-150300.4.9.1 | SUSE-SU-2023:4467-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-urllib3 | 1.26.18-r0 | — |
| Alpine v3.23 | py3-urllib3 | 1.26.18-r0 | — |
| Alpine v3.22 | py3-urllib3 | 1.26.18-r0 | — |
| Alpine v3.21 | py3-urllib3 | 1.26.18-r0 | — |
| Alpine v3.20 | py3-urllib3 | 1.26.18-r0 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | py3-urllib3 | 1.26.18-r0 | — |
| Alpine v3.18 | py3-urllib3 | 1.26.18-r0 | — |
| Alpine v3.17 | py3-urllib3 | 1.26.18-r0 | — |
| Alpine v3.16 | py3-urllib3 | 1.26.18-r0 | — |
| Alpine v3.15 | py3-urllib3 | 1.26.18-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3-urllib3 | 1.25.10-5.amzn2023.0.8 | ALAS2023-2026-3150 |
| Amazon Linux 2 | python-urllib3 | 1.25.9-1.amzn2.0.3 | ALAS2-2024-2387 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-pip | 24.2-1 | — |
| Azure Linux 3 | python-urllib3 | 2.0.7-1 | — |
| Azure Linux 2 (CBL-Mariner) | python-urllib3 | 1.26.18-1 | — |
| Azure Linux 2 (CBL-Mariner) | python3 | 3.9.19-14 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | fence-virt +12 | 4.10.0-62.el9 | ELSA-2024-2132 |
| Oracle Linux 9 | python3-urllib3 | 1.26.5-3.0.1.el9_3.1 | ELSA-2024-0464 |
| Oracle Linux 9 | python3.11-urllib3 | 1.26.12-2.el9_5.2 | ELSA-2024-11238 |
| Oracle Linux 8 | aardvark-dns | 2:1.10.0-1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | buildah +1 | 2:1.33.6-2.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | cockpit-podman | 84.1-1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | conmon | 3:2.1.10-1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | container-selinux | 2:2.229.0-2.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | containernetworking-plugins | 1:1.4.0-2.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | containers-common | 2:1-81.0.1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | crit +4 | 3.18-4.module+el8.9.0+90147+a4870853 | ELSA-2024-2988 |
| Oracle Linux 8 | crun | 1.14.3-2.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | fence-agents-all +40 | 4.2.1-129.el8 | ELSA-2024-2968 |
| Oracle Linux 8 | fuse-overlayfs | 1.13-1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | libslirp +1 | 4.4.0-1.module+el8.9.0+90147+a4870853 | ELSA-2024-2988 |
| Oracle Linux 8 | netavark | 2:1.10.3-1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | oci-seccomp-bpf-hook | 1.2.10-1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | podman +6 | 3:4.9.4-0.1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | python3-podman | 4.9.0-1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | python3-urllib3 | 1.24.2-5.0.1.el8_9.2 | ELSA-2024-0116 |
| Oracle Linux 8 | python3.11-urllib3 | 1.26.12-5.el8_10 | ELSA-2024-11189 |
| Oracle Linux 8 | runc | 1:1.1.12-1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | skopeo +1 | 2:1.14.3-0.1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | slirp4netns | 1.2.3-1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | udica | 0.2.6-20.module+el8.9.0+90147+a4870853 | ELSA-2024-2988 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | az +1 | 2.67.0-r1 | — |
| Wolfi rolling | jwt-tool | 2.2.6-r2 | — |
| Wolfi rolling | kubeflow-jupyter-web-app | 1.8.0-r2 | — |
| Wolfi rolling | kubeflow-katib +17 | 0.18.0-r0 | — |
| Wolfi rolling | kubeflow-volumes-web-app | 1.7.0-r8 | — |
| Wolfi rolling | py3-cassandra-medusa +1 | 0.23.0-r0 | — |
| Wolfi rolling | py3-pipenv +9 | 2024.4.1-r0 | — |
| Wolfi rolling | py3-tensorflow-serving-api | 2.14.1-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | urllib3 | >= 2.0.0, < 2.0.7 | 2.0.7 | GHSA-g4mx-q9vg-27p4 |
| PyPI | urllib3 | < 1.26.18 | 1.26.18 | GHSA-g4mx-q9vg-27p4 |
| PyPI | urllib3 | >= 2.0.0, < 2.0.7 · < 1.26.18 | 2.0.7, 1.26.18 | PYSEC-2023-212 |
Advisories 50
- ALSA-2024:2132 Moderate: fence-agents security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:0464 Moderate: python-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:11238 Moderate: python3.11-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:11189 Moderate: python3.11-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2952 Moderate: resource-agents security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2968 Moderate: fence-agents security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:0116 Moderate: python-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:2988 Red Hat Security Advisory: container-tools:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2024-1003 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
- ALAS2023-2026-3150 Moderate: python-urllib3 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 12, 2026
- RHSA-2024:2968 Red Hat Security Advisory: fence-agents security and bug fix update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2024:2952 Red Hat Security Advisory: resource-agents security and bug fix update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2024:2132 Red Hat Security Advisory: fence-agents security and bug fix update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2024:1155 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHBA-2024:1398 Red Hat Bug Fix Advisory: fence-agents update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHBA-2024:1137 Red Hat Bug Fix Advisory: fence-agents bug fix update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHBA-2024:1091 Red Hat Bug Fix Advisory: fence-agents bug fix update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHBA-2024:1114 Red Hat Bug Fix Advisory: fence-agents bug fix update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- openSUSE-SU-2026:12044-1 python313-urllib3-2.8.0-1.1 on GA media SUSE / openSUSE Security Updates · Oct 5, 2026
- openSUSE-SU-2026:12045-1 python313-urllib3_1-1.26.20-7.2 on GA media SUSE / openSUSE Security Updates · Oct 5, 2026
- RHBA-2024:1420 Red Hat Bug Fix Advisory: resource-agents update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2025:1813 Red Hat Security Advisory: python3.11-urllib3 security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2025:1793 Red Hat Security Advisory: python3.11-urllib3 security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2025:0078 Red Hat Security Advisory: python3.11-urllib3 security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2024:2734 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-urllib3) security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2024:11238 Red Hat Security Advisory: python3.11-urllib3 security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2024:11189 Red Hat Security Advisory: python3.11-urllib3 security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2024:0588 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2024:0300 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2024:0464 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2024:0116 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2023:7851 Red Hat Security Advisory: Satellite 6.14.1 Async Security Update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-6473-2 python-pip vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-6473-1 python-urllib3 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-7762-1 python-pip vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- WID-SEC-2024-1228 Red Hat OpenStack: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2026
- DLA-3649-1 python-urllib3 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3998-1 python-urllib3 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2024:11238 Moderate: python3.11-urllib3 security update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2024:2968 Moderate: fence-agents security and bug fix update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2023:4467-1 Security update for python-urllib3 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13343-1 python310-urllib3-2.0.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4356-1 Security update for python-urllib3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2462-1 Security update for python-urllib3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4352-1 Security update for python-urllib3 SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2024:11189 Moderate: python3.11-urllib3 security update Rocky Linux Security Advisories · Oct 9, 2025
- WID-SEC-2023-2964 Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 24, 2025
- RLSA-2024:2952 Moderate: resource-agents security and bug fix update Rocky Linux Security Advisories · May 7, 2025
- RLSA-2024:2988 Moderate: container-tools:rhel8 security update Rocky Linux Security Advisories · May 7, 2025
References
- https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4
- https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9
- https://www.rfc-editor.org/rfc/rfc9110.html#name-get
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5/