What’s Vulnerable › Vulnerabilities

CVE-2023-43804: `Cookie` HTTP header isn't stripped on cross-origin redirects

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-04 · updated 2026-06-17
• Weakness: CWE-200

Description

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.

Affected products

• Debian Linux: 10.0
• Fedoraproject Fedora: 37, 38, 39
• urllib3: before 1.26.17; from 2.0.0 before 2.0.6 — fixed in 1.26.17, 2.0.6
• Pypi Urllib3: from 2.0.0 before 2.0.6; before 1.26.17; 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5 (+79) — fixed in 2.0.6, 1.26.17

How to fix

Upgrade to a fixed version: urllib3 1.26.17, 2.0.6; Pypi Urllib3 2.0.6, 1.26.17. Check the vendor advisory for mitigations.

References

• https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb
• https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d
• https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f
• https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I3PR7C6RJ6JUBQKIJ644DMIJSUP36VDY/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAGZXYJ7H2G3SB47M453VQVNAWKAEJJ/
• https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb
• https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d
• https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f
• https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
• https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html

Get alerted when CVE-2023-43804 or the next vulnerability affects your stack