urllib3
- Total products in the ecosystem
- 1
- Total vulnerabilities (90 days)
- 0
en
Verify to analyze this security profile
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-9375 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/19/2026 | SeverityUnknown |
CVE-2026-44431urllib3: Sensitive headers forwarded across origins in proxied low-level redirects | Exploitation statusNot known exploited | FixYes | Affected producturllib3 | Published05/13/2026 | SeverityHigh |
CVE-2026-44432urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API | Exploitation statusNot known exploited | FixYes | Affected producturllib3 | Published05/13/2026 | SeverityHigh |
CVE-2026-21441urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) | Exploitation statusNot known exploited | FixNot confirmed | Affected producturllib3 | Published01/07/2026 | SeverityHigh |
CVE-2025-66471urllib3 Streaming API improperly handles highly compressed data | Exploitation statusNot known exploited | FixNot confirmed | Affected producturllib3 | Published12/05/2025 | SeverityHigh |
CVE-2025-66418urllib3 allows an unbounded number of links in the decompression chain | Exploitation statusNot known exploited | FixYes | Affected producturllib3 | Published12/05/2025 | SeverityHigh |
CVE-2025-50182urllib3 does not control redirects in browsers and Node.js | Exploitation statusNot known exploited | FixYes | Affected producturllib3 | Published06/19/2025 | SeverityMedium |
CVE-2025-50181urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation | Exploitation statusNot known exploited | FixYes | Affected producturllib3 | Published06/19/2025 | SeverityMedium |
CVE-2024-37891Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3 | Exploitation statusNot known exploited | FixNot confirmed | Affected producturllib3 | Published06/17/2024 | SeverityMedium |
CVE-2023-45803Request body not stripped after redirect in urllib3 | Exploitation statusNot known exploited | FixNot confirmed | Affected producturllib3 | Published10/17/2023 | SeverityMedium |
CVE-2023-43804`Cookie` HTTP header isn't stripped on cross-origin redirects | Exploitation statusNot confirmed | FixYes | Affected producturllib3 | Published10/04/2023 | SeverityMedium |