TI-2026-64264 CVE-2026-97689 · GHSA-vxq7-64xx-v4gw
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
Priority LOW 38
urllib3 is an HTTP client library for Python.
Vulnerabilities
22 records
TI-2026-64263 CVE-2026-97688 · GHSA-gh4c-6fx4-qh6g
urllib3: Chunked Deflate streaming can enter an infinite loop
Priority LOW 36
urllib3 is an HTTP client library for Python.
TI-2026-64262 CVE-2026-97687 · GHSA-8988-9cw3-xx77
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
Priority LOW 35
urllib3 is an HTTP client library for Python.
TI-2026-32372 CVE-2026-44431 · GHSA-qccp-gfcp-xxvc
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
Priority LOW 36
urllib3 is an HTTP client library for Python.
TI-2026-32373 CVE-2026-44432 · GHSA-mf9v-mfxr-j63j
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
Priority MEDIUM 40
urllib3 is an HTTP client library for Python.
TI-2026-17326 CVE-2026-21441 · GHSA-38jv-5279-wg99
urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
Priority MEDIUM 50
urllib3 is an HTTP client library for Python.
TI-2025-40898 CVE-2025-66471 · GHSA-2xpw-w6gg-jr37
urllib3 Streaming API improperly handles highly compressed data
Priority MEDIUM 40
urllib3 is a user-friendly HTTP client library for Python.
TI-2025-40854 CVE-2025-66418 · GHSA-gm62-xv2j-4w53
urllib3 allows an unbounded number of links in the decompression chain
Priority MEDIUM 46
urllib3 is a user-friendly HTTP client library for Python.
TI-2025-32065 CVE-2025-50182 · GHSA-48p4-8xcf-vxj5
urllib3 does not control redirects in browsers and Node.js
Priority LOW 28
urllib3 is a user-friendly HTTP client library for Python.
TI-2025-32064 CVE-2025-50181 · GHSA-pq67-6m6q-mj2v
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
Priority LOW 28
urllib3 is a user-friendly HTTP client library for Python.
TI-2024-25208 CVE-2024-37891 · GHSA-34jh-p97f-mpxf
Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3
Priority LOW 31
urllib3 is a user-friendly HTTP client library for Python.
TI-2023-24565 CVE-2023-45803 · GHSA-g4mx-q9vg-27p4
Request body not stripped after redirect in urllib3
Priority LOW 20
urllib3 is a user-friendly HTTP client library for Python.
TI-2018-15318 CVE-2018-25091 · GHSA-gwvm-45gx-3cf8
urllib3 before 1.24.2 does not remove the authorization HTTP header when following a…
Priority LOW 28
urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme).
TI-2023-23495 CVE-2023-43804 · GHSA-v845-jxx5-vc9f
`Cookie` HTTP header isn't stripped on cross-origin redirects
Priority LOW 38
urllib3 is a user-friendly HTTP client library for Python.
TI-2021-12905 CVE-2021-33503 · GHSA-q2q7-5pp4-w6pg
An issue was discovered in urllib3 before 1.26.5.
Priority LOW 39
An issue was discovered in urllib3 before 1.26.5.
TI-2021-09525 CVE-2021-28363 · GHSA-5phf-pp7p-vc2r
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in…
Priority LOW 33
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies.
TI-2020-15974 CVE-2020-26137 · GHSA-wqvq-5m8c-6g24
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request…
Priority LOW 33
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest().
TI-2020-05823 CVE-2020-7212 · GHSA-hmv2-79q8-fv6g
The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through…
Priority LOW 39
The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm.
TI-2019-08458 CVE-2019-11324 · GHSA-mh33-7rrq-662w
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired…
Priority LOW 38
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations…
TI-2019-08411 CVE-2019-11236 · GHSA-r64q-w8jr-g9qp
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the…
Priority LOW 31
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
TI-2018-14221 CVE-2018-20060 · GHSA-www2-v7xj-xrc6
urllib3 before version 1.23 does not remove the Authorization HTTP header when following…
Priority MEDIUM 49
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme).
TI-2016-07382 CVE-2016-9015 · GHSA-v4w5-p2hg-8fh6
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can…
Priority LOW 19
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates.