What’s Vulnerable › Products

urllib3 vulnerabilities

22 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your urllib3 version is affected

Latest urllib3 vulnerabilities

• CVE-2026-97689 — urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory (CVSS 7.5)
• CVE-2026-97688 — urllib3: Chunked Deflate streaming can enter an infinite loop (CVSS 5.3)
• CVE-2026-97687 — urllib3: HTTPS proxy TLS configuration may be ignored or overridden (CVSS 8.1)
• CVE-2026-44432 — urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API (CVSS 7.5)
• CVE-2026-44431 — urllib3: Sensitive headers forwarded across origins in proxied low-level redirects (CVSS 5.3)
• CVE-2026-21441 — urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVSS 7.5)
• CVE-2025-66471 — urllib3 Streaming API improperly handles highly compressed data (CVSS 7.5)
• CVE-2025-66418 — urllib3 allows an unbounded number of links in the decompression chain (CVSS 7.5)
• CVE-2025-50182 — urllib3 does not control redirects in browsers and Node.js (CVSS 6.1)
• CVE-2025-50181 — urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation (CVSS 6.1)
• CVE-2024-37891 — Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3 (CVSS 6.5)
• CVE-2023-45803 — Request body not stripped after redirect in urllib3 (CVSS 4.2)
• CVE-2018-25091 — (CVSS 6.1)
• CVE-2023-43804 — `Cookie` HTTP header isn't stripped on cross-origin redirects (CVSS 8.1)
• CVE-2021-33503 — Catastrophic backtracking in URL authority parser when passed URL containing many @ characters (CVSS 7.5)
• CVE-2021-28363 — (CVSS 6.5)
• CVE-2020-26137 — (CVSS 6.5)
• CVE-2020-7212 — (CVSS 7.5)
• CVE-2019-11324 — (CVSS 7.5)
• CVE-2019-11236 — (CVSS 6.1)
• CVE-2018-20060 — (CVSS 9.8)
• CVE-2016-9015 — (CVSS 3.7)