CVE-2026-44431: urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-13 · updated 2026-06-26
Weakness: CWE-200

Description

urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.

Affected products

urllib3: from 1.23 before 2.7.0 — fixed in 2.7.0
Pypi Urllib3: from 1.23 before 2.7.0; 1.23, 1.24, 1.24.1, 1.24.2, 1.24.3, 1.25 (+56) — fixed in 2.7.0

How to fix

Upgrade to a fixed version: urllib3 2.7.0; Pypi Urllib3 2.7.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-44431 or the next vulnerability affects your stack