CVE-2018-20060

CVE-2018-20060 affects urllib3/python-urllib3 prior to 1.23, where the Authorization header is not removed on cross-origin redirects. This can allow credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext. Public sources in the Connected documents ind...

CVE-2023-43804

CVE-2023-43804 affects the Python urllib3 library, where a Cookie header may be leaked across cross-origin redirects if redirects are not disabled. The issue is resolved in urllib3 1.26.17 or 2.0.5. Affected environments are confirmed in multiple reports, including AlmaLinux and Brocade advisorie...

CVE-2019-11324

The issue CVE-2019-11324 affects the Python urllib3 library prior to 1.24.2, where SSL verification can be bypassed when the SSLContext, ca_certs, or ca_certs_dir arguments differ from the OS CA store, causing TLS handshakes to succeed when they should fail. This is related to how system vs manua...

CVE-2020-26137

CVE-2020-26137 pertains to Python’s urllib3 and is explicitly described as a CRLF injection vulnerability in the HTTP request handling of urllib3/http.client. The connected advisories show affected package and version details: python-urllib3 1.24.2-2 (CBLMariner entry) and a recommended upgrade t...

CVE-2023-45803

CVE-2023-45803 affects the Python urllib3 library. The issue arises when handling HTTP redirects (301/302/303) after a request’s method changes from something that can carry a body (e.g., POST) to GET, where urllib3 previously did not remove the HTTP request body. This could allow leakage of sens...

CVE-2024-37891

CVE-2024-37891 affects urllib3 (Python HTTP client) across multiple distributions (e.g., python3-urllib3, python3.13-pip, python-pip, etc.). The issue: when not using urllib3’s ProxyManager proxy support, a configured Proxy-Authorization header could be sent, and urllib3 may not strip it on cross...

CVE-2018-25091

CVE-2018-25091 affects the urllib3 library (before 1.24.2). When following cross-origin redirects, urllib3 may not remove the Authorization header, allowing credentials to be exposed to unintended hosts or transmitted in cleartext. This is noted as a follow-on from an incomplete fix for CVE-2018-...

CVE-2025-50181

CVE-2025-50181 affects python-urllib3 and was fixed in urllib3 2.5.0. Several connected advisories confirm vulnerable versions are older releases (e.g., python-urllib3