urllib3 vulnerabilities

CVEs per yearBy the year they were published

1. 20232
2. 20241
3. 20254
4. 20266

Newest CVEs

• CVE-2026-97689

  urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

  urllib3 · urllib3

  High8.9
• CVE-2026-97688

  urllib3: Chunked Deflate streaming can enter an infinite loop

  urllib3 · urllib3

  Medium6.9
• CVE-2026-97687

  urllib3: HTTPS proxy TLS configuration may be ignored or overridden

  urllib3 · urllib3

  High7.6
• CVE-2026-44431

  urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

  urllib3 · urllib3

  High8.2
• CVE-2026-44432

  urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

  urllib3 · urllib3

  High8.9
• CVE-2026-21441

  urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

  urllib3 · urllib3

  High8.9
• CVE-2025-66471

  urllib3 Streaming API improperly handles highly compressed data

  urllib3 · urllib3

  High8.9
• CVE-2025-66418

  urllib3 allows an unbounded number of links in the decompression chain

  urllib3 · urllib3

  High8.9
• CVE-2025-50182

  urllib3 does not control redirects in browsers and Node.js

  urllib3 · urllib3

  Medium5.3
• CVE-2025-50181

  urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

  urllib3 · urllib3

  Medium5.3