UR
Product
Urllib3
22
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 1High 10Medium 10Low 1
Watch
Add Urllib3 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-20060 | 9.8 | Dec 11 | urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme) Affected: before 1.23 |
| CVE-2026-97687 | 8.1 | Sep 29 | urllib3: HTTPS proxy TLS configuration may be ignored or overridden Affected: 1.26.0 before 2.8.0 |
| CVE-2023-43804 | 8.1 | Oct 4 | urllib3 is a user-friendly HTTP client library for Python Affected: before 1.26.17; 2.0.0 before 2.0.6 |
| CVE-2026-97689 | 7.5 | Sep 29 | urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory Affected: 1.10.3 before 2.8.0 |
| CVE-2026-44432 | 7.5 | May 13 | urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API Affected: 2.6.0 before 2.7.0 |
| CVE-2026-21441 | 7.5 | Jan 7 | urllib3 is an HTTP client library for Python Affected: 1.22 before 2.6.3 |
| CVE-2025-66471 | 7.5 | Dec 5 | urllib3 is a user-friendly HTTP client library for Python Affected: 1.0 before 2.6.0 |
| CVE-2025-66418 | 7.5 | Dec 5 | urllib3 is a user-friendly HTTP client library for Python Affected: 1.24 before 2.6.0 |
| CVE-2021-33503 | 7.5 | Jun 29 | An issue was discovered in urllib3 before 1.26.5 Affected: 1.25.4 before 1.26.5 |
| CVE-2020-7212 | 7.5 | Mar 6 | The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient… Affected: 1.25.2 through 1.25.7 |
| CVE-2019-11324 | 7.5 | Apr 18 | The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in… Affected: before 1.24.2 |
| CVE-2024-37891 | 6.5 | Jun 17 | urllib3 is a user-friendly HTTP client library for Python Affected: before 1.26.19; 2.0.0 before 2.2.2 |
| CVE-2021-28363 | 6.5 | Mar 15 | The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies Affected: 1.26.0 before 1.26.4 |
| CVE-2020-26137 | 6.5 | Sep 30 | urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of… Affected: before 1.25.9 |
| CVE-2025-50182 | 6.1 | Jun 19 | urllib3 is a user-friendly HTTP client library for Python Affected: 2.2.0 before 2.5.0 |
| CVE-2025-50181 | 6.1 | Jun 19 | urllib3 is a user-friendly HTTP client library for Python Affected: before 2.5.0 |
| CVE-2018-25091 | 6.1 | Oct 15 | urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme) Affected: before 1.24.2 |
| CVE-2019-11236 | 6.1 | Apr 15 | In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter Affected: through 1.24.2 |
| CVE-2026-97688 | 5.3 | Sep 29 | urllib3: Chunked Deflate streaming can enter an infinite loop Affected: 2.6.2 before 2.8.0 |
| CVE-2026-44431 | 5.3 | May 13 | urllib3: Sensitive headers forwarded across origins in proxied low-level redirects Affected: 1.23 before 2.7.0 |
| CVE-2023-45803 | 4.2 | Oct 17 | urllib3 is a user-friendly HTTP client library for Python Affected: before 1.26.18; 2.0.0 before 2.0.7 |
| CVE-2016-9015 | 3.7 | Jan 11 | Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates Affected: 1.17; 1.18 |
Showing 22