urllib3 has 9 CVEs on record between 2021 and 2025. The median CVSS is 5.3 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Products
- urllib3 9
Worst active — by depth score
CVE-2023-43804Medium· 5.9`Cookie` HTTP header isn't stripped on cross-origin redirects45CVE-2021-33503High· 7.5Catastrophic backtracking in URL authority parser when passed URL containing many @ characters42CVE-2025-66471Highurllib3 streaming API improperly handles highly compressed data41CVE-2025-66418Highurllib3 allows an unbounded number of links in the decompression chain41CVE-2021-28363Medium· 6.5Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection36
urllib3 vulnerabilities
CVEs affecting urllib3, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2025-66418Highurllib3 allows an unbounded number of links in the decompression chain
urllib3 allows an unbounded number of links in the decompression chain
CVE-2025-66471Highurllib3 streaming API improperly handles highly compressed data
urllib3 streaming API improperly handles highly compressed data
CVE-2025-50181Medium· 5.3urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
CVE-2025-50182Medium· 5.3urllib3 does not control redirects in browsers and Node.js
urllib3 does not control redirects in browsers and Node.js
CVE-2024-37891Medium· 4.4urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
CVE-2023-45803Medium· 4.2urllib3's request body not stripped after redirect from 303 status changes request method to GET
urllib3's request body not stripped after redirect from 303 status changes request method to GET
CVE-2023-43804Medium· 5.9PoC`Cookie` HTTP header isn't stripped on cross-origin redirects
`Cookie` HTTP header isn't stripped on cross-origin redirects
CVE-2021-33503High· 7.5Catastrophic backtracking in URL authority parser when passed URL containing many @ characters
Catastrophic backtracking in URL authority parser when passed URL containing many @ characters
CVE-2021-28363Medium· 6.5Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection
Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection