urllib3 vulnerabilities
CVEs whose affected-version data names the urllib3 package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
9 CVEsRSS
CVE-2026-44432High· 7.5urllib3 is an HTTP client library for Python
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed…
CVE-2026-21441High· 7.5urllib3 is an HTTP client library for Python
urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urll…
CVE-2025-66418Highurllib3 allows an unbounded number of links in the decompression chain
urllib3 allows an unbounded number of links in the decompression chain
CVE-2025-66471Highurllib3 streaming API improperly handles highly compressed data
urllib3 streaming API improperly handles highly compressed data
CVE-2024-37891Medium· 4.4urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
CVE-2023-45803Medium· 4.2urllib3's request body not stripped after redirect from 303 status changes request method to GET
urllib3's request body not stripped after redirect from 303 status changes request method to GET
CVE-2023-43804Medium· 5.9PoC`Cookie` HTTP header isn't stripped on cross-origin redirects
`Cookie` HTTP header isn't stripped on cross-origin redirects
CVE-2021-33503High· 7.5Catastrophic backtracking in URL authority parser when passed URL containing many @ characters
Catastrophic backtracking in URL authority parser when passed URL containing many @ characters
CVE-2021-28363Medium· 6.5Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection
Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection