Python Urllib3 vulnerabilities

• python urllib3 urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory CVE-2026-97689 Fix available 8.9 HighSeptember 29, 2026
• python urllib3 urllib3: Chunked Deflate streaming can enter an infinite loop CVE-2026-97688 Fix available 6.9 MediumSeptember 29, 2026
• python urllib3 urllib3: HTTPS proxy TLS configuration may be ignored or overridden CVE-2026-97687 Fix available 7.6 HighSeptember 29, 2026
• python urllib3, red hat exploit intelligence, external secrets operator for red hat openshift +48 more +50 more urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API CVE-2026-44432 Fix available 8.9 HighMay 11, 2026
• python urllib3 urllib3: Sensitive headers forwarded across origins in proxied low-level redirects CVE-2026-44431 Fix available 8.2 HighMay 11, 2026
• python urllib3, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift 1.18 +105 more +107 more urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-21441 Fix available 8.9 HighJanuary 7, 2026
• python urllib3 urllib3 Streaming API improperly handles highly compressed data CVE-2025-66471 Fix available 8.9 HighDecember 5, 2025
• python urllib3 urllib3 allows an unbounded number of links in the decompression chain CVE-2025-66418 Fix available 8.9 HighDecember 5, 2025
• python urllib3 urllib3 does not control redirects in browsers and Node.js CVE-2025-50182 Fix available 5.3 MediumJune 18, 2025
• python urllib3 urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation CVE-2025-50181 Fix available 5.3 MediumJune 18, 2025
• python urllib3, debian linux, netapp active iq unified manager +2 more Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3 CVE-2024-37891 Fix available 4.4 MediumJune 17, 2024
• python urllib3, fedoraproject fedora +1 more Request body not stripped after redirect in urllib3 CVE-2023-45803 Fix available 4.2 MediumOctober 17, 2023
• python urllib3 Authorization Header forwarded on redirect CVE-2018-25091 Fix available 6.1 MediumOctober 8, 2023
• python urllib3, debian linux, fedoraproject fedora +2 more `Cookie` HTTP header isn't stripped on cross-origin redirects CVE-2023-43804 Public exploitFix available 5.9 MediumOctober 2, 2023
• python urllib3, fedoraproject fedora, oracle enterprise manager ops center +2 more +4 more Catastrophic backtracking in URL authority parser when passed URL containing many @ characters CVE-2021-33503 Fix available 7.5 HighJune 1, 2021
• python urllib3, fedoraproject fedora, oracle peoplesoft enterprise peopletools +3 more +5 more Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection CVE-2021-28363 Fix available 6.5 MediumMarch 15, 2021
• python urllib3, canonical ubuntu linux, debian linux +2 more +4 more CRLF injection in urllib3 CVE-2020-26137 Fix available 6.5 MediumSeptember 29, 2020
• python urllib3 Uncontrolled Resource Consumption in urllib3 CVE-2020-7212 Fix available 7.5 HighMarch 6, 2020
• python urllib3, canonical ubuntu linux +1 more Improper Certificate Validation in urllib3 CVE-2019-11324 Fix available 7.5 HighApril 18, 2019
• python urllib3 Improper Neutralization of CRLF Sequences in urllib3 library for Python CVE-2019-11236 Fix available 6.1 MediumApril 15, 2019
• python urllib3, fedoraproject fedora +1 more Exposure of Sensitive Information to an Unauthorized Actor in urllib3 CVE-2018-20060 Fix available 9.8 CriticalDecember 11, 2018
• python urllib3 Urllib3 Incorrect Certificate Validation CVE-2016-9015 Fix available 3.7 LowJanuary 11, 2017