---
id: CVE-2026-44431
title: urllib3 is an HTTP client library for Python
summary: >-
  urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0,
  cross-origin redirects followed from the low-level API via
  ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still
  forward these sensitive hea…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-200
  - CWE-201
published: '2026-05-13'
updated: '2026-06-26'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44431'
references:
  - url: 'https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc'
    label: security-advisories@github.com
  - url: 'https://lists.debian.org/debian-lts-announce/2026/06/msg00040.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44431.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-44431'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2477167'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-44431'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44431'
  - url: 'https://access.redhat.com/errata/RHSA-2026:34160'
  - url: 'https://access.redhat.com/errata/RHSA-2026:27929'
  - url: 'https://access.redhat.com/errata/RHSA-2026:49927'
  - url: 'https://access.redhat.com/errata/RHSA-2026:32992'
  - url: 'https://access.redhat.com/errata/RHSA-2026:51152'
  - url: 'https://access.redhat.com/errata/RHSA-2026:51157'
  - url: 'https://access.redhat.com/errata/RHSA-2026:51045'
  - url: 'https://access.redhat.com/errata/RHSA-2026:28159'
  - url: 'https://access.redhat.com/errata/RHSA-2026:28157'
  - url: 'https://access.redhat.com/errata/RHSA-2026:28000'
  - url: 'https://access.redhat.com/errata/RHSA-2026:36732'
  - url: 'https://access.redhat.com/errata/RHSA-2026:60362'
  - url: 'https://access.redhat.com/errata/RHSA-2026:60371'
  - url: 'https://access.redhat.com/errata/RHSA-2026:59409'
  - url: 'https://access.redhat.com/errata/RHSA-2026:28158'
  - url: 'https://access.redhat.com/errata/RHSA-2026:47126'
  - url: 'https://access.redhat.com/errata/RHSA-2026:47091'
  - url: 'https://access.redhat.com/errata/RHSA-2026:47092'
  - url: 'https://access.redhat.com/errata/RHSA-2026:47129'
  - url: 'https://access.redhat.com/errata/RHSA-2026:30078'
  - url: 'https://access.redhat.com/errata/RHSA-2026:30089'
  - url: 'https://access.redhat.com/errata/RHSA-2026:30088'
  - url: 'https://access.redhat.com/errata/RHSA-2026:30087'
  - url: 'https://access.redhat.com/errata/RHSA-2026:24542'
  - url: 'https://github.com/urllib3/urllib3'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.00339
epssPercentile: 0.24638
ingestedAt: '2026-06-26T16:43:13.643Z'
vendor: Red Hat
product: Red Hat Enterprise Linux AppStream (v. 8)
affected:
  - exploit_intelligence
  - migration_toolkit_for_containers
  - migration_toolkit_for_virtualization
  - openshift_lightspeed
  - pen_drive_powered_by_red_hat_lightspeed
  - ai_inference_server
  - ansible_automation_platform 2
  - developer_hub
  - enterprise_linux 7
  - hardened_images
  - openshift_ai_rhoai
  - openshift_container_platform 4
  - openshift_virtualization 4
  - quay 3
  - trusted_artifact_signer
  - service_telemetry_framework 1.5
  - ansible_automation_platform_2_6_for_rhel 9
  - enterprise_linux_appstream_v_10
  - enterprise_linux_appstream_v_8
  - enterprise_linux_appstream_aus_v_8_4
  - enterprise_linux_appstream_eus_extension_v_8_4
  - enterprise_linux_appstream_aus_v_8_6
  - enterprise_linux_appstream_eus_extension_v_8_6
  - enterprise_linux_appstream_e4s_v_8_8
  - enterprise_linux_appstream_tus_v_8_8
  - enterprise_linux_appstream_v_9
  - enterprise_linux_baseos_v_10
  - enterprise_linux_baseos_v_8
  - enterprise_linux_baseos_e4s_v_9_2
  - enterprise_linux_baseos_e4s_v_9_4
  - enterprise_linux_baseos_eus_v_9_6
  - enterprise_linux_baseos_v_9
  - enterprise_linux_highavailability_v_8
  - enterprise_linux_high_availability_aus_v_8_4
  - enterprise_linux_highavailability_eus_extension_v_8_4
  - enterprise_linux_high_availability_eus_extension_v_8_6
  - enterprise_linux_high_availability_e4s_v_8_8
  - enterprise_linux_high_availability_tus_v_8_8
  - ai_inference_server 3.3
  - ai_inference_server 3.4
patched:
  - ansible_automation_platform_2_6_for_rhel 9
  - enterprise_linux_appstream_v_10
  - enterprise_linux_appstream_v_8
  - enterprise_linux_appstream_aus_v_8_4
  - enterprise_linux_appstream_eus_extension_v_8_4
  - enterprise_linux_appstream_aus_v_8_6
  - enterprise_linux_appstream_eus_extension_v_8_6
  - enterprise_linux_appstream_e4s_v_8_8
  - enterprise_linux_appstream_tus_v_8_8
  - enterprise_linux_appstream_v_9
  - enterprise_linux_baseos_v_10
  - enterprise_linux_baseos_v_8
  - enterprise_linux_baseos_e4s_v_9_2
  - enterprise_linux_baseos_e4s_v_9_4
  - enterprise_linux_baseos_eus_v_9_6
  - enterprise_linux_baseos_v_9
  - enterprise_linux_highavailability_v_8
  - enterprise_linux_high_availability_aus_v_8_4
  - enterprise_linux_highavailability_eus_extension_v_8_4
  - enterprise_linux_high_availability_eus_extension_v_8_6
  - enterprise_linux_high_availability_e4s_v_8_8
  - enterprise_linux_high_availability_tus_v_8_8
  - ai_inference_server 3.3
  - ai_inference_server 3.4
  - ansible_automation_platform 2.5
  - ansible_automation_platform 2.6
  - ansible_automation_platform 2.7
  - discovery 2
  - hardened_images
  - migration_toolkit_for_applications 8.2
  - openshift_ai 2.25
  - openshift_ai 3.3
  - satellite 6.17
  - satellite 6.18
  - satellite 6.19
  - trusted_artifact_signer 1.4
  - update_infrastructure 5
  - enterprise_linux_resilientstorage_v_8
scores:
  nvd: 5.3
  vendor: 5.9
  osv: 5.3
aliases:
  - GHSA-qccp-gfcp-xxvc
  - PYSEC-2026-141
ecosystem: pip
---

## Overview

urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:34160** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34160)
- **RHSA-2026:27929** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27929)
- **RHSA-2026:49927** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux HighAvailability (v. 8), Red Hat Enterprise Linux ResilientStorage (v. 8) · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:49927)
- **RHSA-2026:32992** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-06-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:32992)
- **RHSA-2026:51152** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4), Red Hat Enterprise Linux High Availability AUS (v.8.4), Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51152)
- **RHSA-2026:51157** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6), Red Hat Enterprise Linux High Availability EUS EXTENSION (v.8.6) · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51157)
- **RHSA-2026:51045** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8), Red Hat Enterprise Linux High Availability E4S (v.8.8), Red Hat Enterprise Linux High Availability TUS (v.8.8) · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51045)
- **RHSA-2026:28159** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-06-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:28159)
- **RHSA-2026:28157** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-06-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:28157)
- **RHSA-2026:28000** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:28000)
- **RHSA-2026:36732** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8) · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36732)
- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, Migration Toolkit for Containers, Migration Toolkit for Virtualization, OpenShift Lightspeed, Pen Drive Powered by Red Hat Lightspeed, Red Hat AI Inference Server, … · no fix planned: Exploit Intelligence, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Virtualization 4, … · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44431.json)

## Package advisory (CVE-2026-44431)

Affected packages:

- `urllib3 >= 1.23, < 2.7.0`

Patched in:

- `urllib3 2.7.0`

Source: https://osv.dev/vulnerability/GHSA-qccp-gfcp-xxvc