Skip to content
Urllib3 vulnerabilities
Newest
-
python urllib3
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
CVE-2026-97689
Fix available
8.9 High
-
python urllib3
urllib3: Chunked Deflate streaming can enter an infinite loop
CVE-2026-97688
Fix available
6.9 Medium
-
python urllib3
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
CVE-2026-97687
Fix available
7.6 High
-
python urllib3, red hat exploit intelligence, external secrets operator for red hat openshift +48 more +50 more
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
CVE-2026-44432
Fix available
8.9 High
-
python urllib3
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
CVE-2026-44431
Fix available
8.2 High
-
python urllib3, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift 1.18 +105 more +107 more
urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
CVE-2026-21441
Fix available
8.9 High
-
python urllib3
urllib3 Streaming API improperly handles highly compressed data
CVE-2025-66471
Fix available
8.9 High
-
python urllib3
urllib3 allows an unbounded number of links in the decompression chain
CVE-2025-66418
Fix available
8.9 High
-
python urllib3
urllib3 does not control redirects in browsers and Node.js
CVE-2025-50182
Fix available
5.3 Medium
-
python urllib3
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
CVE-2025-50181
Fix available
5.3 Medium
-
python urllib3, debian linux, netapp active iq unified manager +2 more
Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3
CVE-2024-37891
Fix available
4.4 Medium
-
python urllib3, fedoraproject fedora +1 more
Request body not stripped after redirect in urllib3
CVE-2023-45803
Fix available
4.2 Medium
-
python urllib3, debian linux, fedoraproject fedora +2 more
`Cookie` HTTP header isn't stripped on cross-origin redirects
CVE-2023-43804
Public exploitFix available
5.9 Medium