Uurllib3

Products

Exploited and recent CVEs

• CVE-2026-97689 High 8.9 urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory 0.3%
• CVE-2026-97688 Medium 6.9 urllib3: Chunked Deflate streaming can enter an infinite loop 0.3%
• CVE-2026-97687 High 7.6 urllib3: HTTPS proxy TLS configuration may be ignored or overridden 0.2%
• CVE-2026-44431 High 8.2 urllib3: Sensitive headers forwarded across origins in proxied low-level redirects 0.3%
• CVE-2026-44432 High 7.5 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API 0.7%
• CVE-2026-21441 High 7.5 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) 2.9%
• CVE-2025-66471 High 8.9 urllib3 Streaming API improperly handles highly compressed data 0.7%
• CVE-2025-66418 High 8.9 urllib3 allows an unbounded number of links in the decompression chain 0.7%
• CVE-2025-50182 Medium 5.3 urllib3 does not control redirects in browsers and Node.js 0.6%
• CVE-2025-50181 Medium 5.3 urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation 0.5%
• CVE-2024-37891 Medium 4.4 Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3 1.1%
• CVE-2023-45803 Medium 4.2 Request body not stripped after redirect in urllib3 0.6%
• CVE-2023-43804 Medium 5.9 `Cookie` HTTP header isn't stripped on cross-origin redirects 1.4%