CVE-2023-43804Medium· 5.9▾ TwilightPoC available`Cookie` HTTP header isn't stripped on cross-origin redirects
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 32.5 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.2%
1 GitHub repo
urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.
Users must handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the Cookie header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.
We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:
Cookie header on requests, which is mostly typical for impersonating a browser.redirects=False when sending requests.Cookie header.urllib3 >= 2.0.0, < 2.0.6urllib3 < 1.26.17Upgrade to a patched release:
urllib3 2.0.6urllib3 1.26.17Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-45803Medium· 4.2urllib3's request body not stripped after redirect from 303 status changes request method to GET
CVE-2024-37891Medium· 4.4urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
CVE-2021-33503High· 7.5Catastrophic backtracking in URL authority parser when passed URL containing many @ characters
CVE-2025-50181Medium· 5.3urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
CVE-2025-66418Highurllib3 allows an unbounded number of links in the decompression chain
CVE-2021-28363Medium· 6.5Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection