urllib3 (PyPI)
urllib3 is a user-friendly HTTP client library for Python
Advisories
66
Latest version
2.8.0
Released Sep 15, 2026
License
MIT
OpenSSF Scorecard
8.6 / 10
How to fix
Upgrading to 2.8.0 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "urllib3>=2.8.0"poetry
poetry add "urllib3>=2.8.0"uv
uv add "urllib3>=2.8.0"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-vxq7-64xx-v4gw urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory |
High EPSS 0.34% |
>= 1.10.3, < 2.8.0 | 2.8.0 |
| GHSA-vxq7-64xx-v4gw urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory |
High EPSS 0.34% |
>= 1.10.3, < 2.8.0 | 2.8.0 |
| GHSA-vxq7-64xx-v4gw urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory |
High EPSS 0.34% |
>= 1.10.3, < 2.8.0 | 2.8.0 |
| GHSA-gh4c-6fx4-qh6g urllib3: Chunked Deflate streaming can enter an infinite loop |
Medium EPSS 0.29% |
>= 2.6.2, < 2.8.0 | 2.8.0 |
| GHSA-gh4c-6fx4-qh6g urllib3: Chunked Deflate streaming can enter an infinite loop |
Medium EPSS 0.29% |
>= 2.6.2, < 2.8.0 | 2.8.0 |
| GHSA-gh4c-6fx4-qh6g urllib3: Chunked Deflate streaming can enter an infinite loop |
Medium EPSS 0.29% |
>= 2.6.2, < 2.8.0 | 2.8.0 |
| GHSA-8988-9cw3-xx77 urllib3: HTTPS proxy TLS configuration may be ignored or overridden |
High EPSS 0.21% |
>= 1.26.0, < 2.8.0 | 2.8.0 |
| GHSA-8988-9cw3-xx77 urllib3: HTTPS proxy TLS configuration may be ignored or overridden |
High EPSS 0.21% |
>= 1.26.0, < 2.8.0 | 2.8.0 |
| GHSA-8988-9cw3-xx77 urllib3: HTTPS proxy TLS configuration may be ignored or overridden |
High EPSS 0.21% |
>= 1.26.0, < 2.8.0 | 2.8.0 |
| GHSA-mf9v-mfxr-j63j urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API |
High EPSS 0.68% |
>= 2.6.0, < 2.7.0 | 2.7.0 |
| GHSA-mf9v-mfxr-j63j urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API |
High EPSS 0.68% |
>= 2.6.0, < 2.7.0 | 2.7.0 |
| GHSA-mf9v-mfxr-j63j urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API |
High EPSS 0.68% |
>= 2.6.0, < 2.7.0 | 2.7.0 |
| GHSA-qccp-gfcp-xxvc urllib3: Sensitive headers forwarded across origins in proxied low-level redirects |
High EPSS 0.33% |
>= 1.23, < 2.7.0 | 2.7.0 |
| GHSA-qccp-gfcp-xxvc urllib3: Sensitive headers forwarded across origins in proxied low-level redirects |
High EPSS 0.33% |
>= 1.23, < 2.7.0 | 2.7.0 |
| GHSA-qccp-gfcp-xxvc urllib3: Sensitive headers forwarded across origins in proxied low-level redirects |
High EPSS 0.33% |
>= 1.23, < 2.7.0 | 2.7.0 |
| GHSA-38jv-5279-wg99 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) |
High EPSS 2.92% |
>= 1.22, < 2.6.3 | 2.6.3 |
| GHSA-38jv-5279-wg99 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) |
High EPSS 2.92% |
>= 1.22, < 2.6.3 | 2.6.3 |
| GHSA-38jv-5279-wg99 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) |
High EPSS 2.92% |
>= 1.22, < 2.6.3 | 2.6.3 |
| GHSA-2xpw-w6gg-jr37 urllib3 streaming API improperly handles highly compressed data |
High EPSS 0.68% |
>= 1.0, < 2.6.0 | 2.6.0 |
| GHSA-2xpw-w6gg-jr37 urllib3 streaming API improperly handles highly compressed data |
High EPSS 0.68% |
>= 1.0, < 2.6.0 | 2.6.0 |
| GHSA-2xpw-w6gg-jr37 urllib3 streaming API improperly handles highly compressed data |
High EPSS 0.68% |
>= 1.0, < 2.6.0 | 2.6.0 |
| GHSA-gm62-xv2j-4w53 urllib3 allows an unbounded number of links in the decompression chain |
High EPSS 0.68% |
>= 1.24, < 2.6.0 | 2.6.0 |
| GHSA-gm62-xv2j-4w53 urllib3 allows an unbounded number of links in the decompression chain |
High EPSS 0.68% |
>= 1.24, < 2.6.0 | 2.6.0 |
| GHSA-gm62-xv2j-4w53 urllib3 allows an unbounded number of links in the decompression chain |
High EPSS 0.68% |
>= 1.24, < 2.6.0 | 2.6.0 |
| GHSA-48p4-8xcf-vxj5 urllib3 does not control redirects in browsers and Node.js |
Medium EPSS 0.60% |
>= 2.2.0, < 2.5.0 | 2.5.0 |
| GHSA-48p4-8xcf-vxj5 urllib3 does not control redirects in browsers and Node.js |
Medium EPSS 0.60% |
>= 2.2.0, < 2.5.0 | 2.5.0 |
| GHSA-48p4-8xcf-vxj5 urllib3 does not control redirects in browsers and Node.js |
Medium EPSS 0.60% |
>= 2.2.0, < 2.5.0 | 2.5.0 |
| GHSA-pq67-6m6q-mj2v urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation |
Medium EPSS 0.47% |
< 2.5.0 | 2.5.0 |
| GHSA-pq67-6m6q-mj2v urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation |
Medium EPSS 0.47% |
< 2.5.0 | 2.5.0 |
| GHSA-pq67-6m6q-mj2v urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation |
Medium EPSS 0.47% |
< 2.5.0 | 2.5.0 |
| GHSA-34jh-p97f-mpxf urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects |
Medium EPSS 1.14% |
>= 2.0.0, < 2.2.2 | 2.2.2 |
| GHSA-34jh-p97f-mpxf urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects |
Medium EPSS 1.14% |
< 1.26.19 | 1.26.19 |
| GHSA-34jh-p97f-mpxf urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects |
Medium EPSS 1.14% |
< 1.26.19 | 1.26.19 |
| GHSA-34jh-p97f-mpxf urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects |
Medium EPSS 1.14% |
>= 2.0.0, < 2.2.2 | 2.2.2 |
| GHSA-34jh-p97f-mpxf urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects |
Medium EPSS 1.14% |
< 1.26.19>= 2.0.0, < 2.2.2 | 1.26.192.2.2 |
| GHSA-g4mx-q9vg-27p4 urllib3's request body not stripped after redirect from 303 status changes request method to GET |
Medium EPSS 0.59% |
>= 2.0.0, < 2.0.7 | 2.0.7 |
| GHSA-g4mx-q9vg-27p4 urllib3's request body not stripped after redirect from 303 status changes request method to GET |
Medium EPSS 0.59% |
< 1.26.18 | 1.26.18 |
| GHSA-g4mx-q9vg-27p4 urllib3's request body not stripped after redirect from 303 status changes request method to GET |
Medium EPSS 0.59% |
>= 2.0.0, < 2.0.7 | 2.0.7 |
| GHSA-g4mx-q9vg-27p4 urllib3's request body not stripped after redirect from 303 status changes request method to GET |
Medium EPSS 0.59% |
< 1.26.18 | 1.26.18 |
| GHSA-g4mx-q9vg-27p4 urllib3's request body not stripped after redirect from 303 status changes request method to GET |
Medium EPSS 0.59% |
>= 2.0.0, < 2.0.7< 1.26.18 | 1.26.182.0.7 |
| GHSA-gwvm-45gx-3cf8 Authorization Header forwarded on redirect |
Medium EPSS 0.59% |
< 1.24.2 | 1.24.2 |
| GHSA-gwvm-45gx-3cf8 Authorization Header forwarded on redirect |
Medium EPSS 0.59% |
< 1.24.2 | 1.24.2 |
| GHSA-v845-jxx5-vc9f `Cookie` HTTP header isn't stripped on cross-origin redirects |
High EPSS 1.36% |
>= 2.0.0, < 2.0.6 | 2.0.6 |
| GHSA-v845-jxx5-vc9f `Cookie` HTTP header isn't stripped on cross-origin redirects |
High EPSS 1.36% |
>= 2.0.0, < 2.0.6< 1.26.17 | 1.26.172.0.6 |
| GHSA-v845-jxx5-vc9f `Cookie` HTTP header isn't stripped on cross-origin redirects |
High EPSS 1.36% |
< 1.26.17 | 1.26.17 |
| GHSA-v845-jxx5-vc9f `Cookie` HTTP header isn't stripped on cross-origin redirects |
High EPSS 1.36% |
>= 2.0.0, < 2.0.6 | 2.0.6 |
| GHSA-v845-jxx5-vc9f `Cookie` HTTP header isn't stripped on cross-origin redirects |
High EPSS 1.36% |
< 1.26.17 | 1.26.17 |
| GHSA-q2q7-5pp4-w6pg Catastrophic backtracking in URL authority parser when passed URL containing many @ characters |
High EPSS 3.27% |
>= 1.25.4, < 1.26.5 | 1.26.5 |
| GHSA-q2q7-5pp4-w6pg Catastrophic backtracking in URL authority parser when passed URL containing many @ characters |
High EPSS 3.27% |
>= 1.25.4, < 1.26.5 | 1.26.5 |
| GHSA-q2q7-5pp4-w6pg Catastrophic backtracking in URL authority parser when passed URL containing many @ characters |
High EPSS 3.27% |
>= 1.25.4, < 1.26.5 | 1.26.5 |
| GHSA-5phf-pp7p-vc2r Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection |
Medium EPSS 2.17% |
>= 1.26.0, < 1.26.4 | 1.26.4 |
| GHSA-5phf-pp7p-vc2r Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection |
Medium EPSS 2.17% |
>= 1.26.0, < 1.26.4 | 1.26.4 |
| GHSA-wqvq-5m8c-6g24 CRLF injection in urllib3 |
Medium EPSS 2.27% |
< 1.25.9 | 1.25.9 |
| GHSA-wqvq-5m8c-6g24 CRLF injection in urllib3 |
Medium EPSS 2.27% |
< 1.25.9 | 1.25.9 |
| GHSA-hmv2-79q8-fv6g Uncontrolled Resource Consumption in urllib3 |
High EPSS 3.37% |
>= 1.25.2, < 1.25.8 | 1.25.8 |
| GHSA-hmv2-79q8-fv6g Uncontrolled Resource Consumption in urllib3 |
High EPSS 3.37% |
>= 1.25.2, < 1.25.8 | 1.25.8 |
| GHSA-mh33-7rrq-662w Improper Certificate Validation in urllib3 |
High EPSS 2.92% |
< 1.24.2 | 1.24.2 |
| GHSA-mh33-7rrq-662w Improper Certificate Validation in urllib3 |
High EPSS 2.92% |
< 1.24.2 | 1.24.2 |
| PYSEC-2019-63 The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA… Withdrawn |
Not rated yet | < 1.24.2 | 1.24.2 |
| GHSA-r64q-w8jr-g9qp Improper Neutralization of CRLF Sequences in urllib3 library for Python |
Medium EPSS 2.07% |
< 1.24.3 | 1.24.3 |
| PYSEC-2019-62 In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. Withdrawn |
Not rated yet | < 1.24.3 | 1.24.3 |
| GHSA-r64q-w8jr-g9qp Improper Neutralization of CRLF Sequences in urllib3 library for Python |
Medium EPSS 2.07% |
< 1.24.3 | 1.24.3 |
| GHSA-www2-v7xj-xrc6 Exposure of Sensitive Information to an Unauthorized Actor in urllib3 |
Critical EPSS 4.49% |
< 1.23 | 1.23 |
| GHSA-www2-v7xj-xrc6 Exposure of Sensitive Information to an Unauthorized Actor in urllib3 |
Critical EPSS 4.49% |
< 1.23 | 1.23 |
| GHSA-v4w5-p2hg-8fh6 Urllib3 Incorrect Certificate Validation |
Low EPSS 0.75% |
>= 1.17, < 1.18.1 | 1.18.1 |
| GHSA-v4w5-p2hg-8fh6 Urllib3 Incorrect Certificate Validation |
Low EPSS 0.75% |
>= 1.17, < 1.18.1 | 1.18.1 |
Source: https://github.com/urllib3/urllib3
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor