CVE-2021-28363Medium· 6.5▾ SunlitUsing default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
2.1%
Users who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via proxy_config.
Only the default SSLContext is impacted.
urllib3 >=1.26.4 has the issue resolved. urllib3<1.26 is not impacted due to not supporting HTTPS requests via HTTPS proxies.
Upgrading is recommended as this is a minor release and not likely to break current usage.
Configuring an SSLContext with check_hostname=True and passing via proxy_config instead of relying on the default SSLContext
If you have any questions or comments about this advisory:
urllib3 >= 1.26.0, < 1.26.4Upgrade to a patched release:
urllib3 1.26.4Connected by shared product, vendor, weakness, or advisory.
CVE-2021-33503High· 7.5Catastrophic backtracking in URL authority parser when passed URL containing many @ characters
CVE-2023-43804Medium· 5.9`Cookie` HTTP header isn't stripped on cross-origin redirects
CVE-2023-45803Medium· 4.2urllib3's request body not stripped after redirect from 303 status changes request method to GET
CVE-2025-66418Highurllib3 allows an unbounded number of links in the decompression chain
CVE-2024-37891Medium· 4.4urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
CVE-2025-66471Highurllib3 streaming API improperly handles highly compressed data