Product by Python Software Foundation
Python urllib3
22 known vulnerabilities in Python urllib3 (Python Software Foundation), 0 of them actively exploited (CISA KEV).
Key figures
22
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-21441 | Urllib3: Improper Handling of Highly Compressed Data (Data Amplification) | 7.5 | |
| Critical | CVE-2018-20060 | Python urllib3: security vulnerability | 9.8 | |
| High | CVE-2020-7212 | Python urllib3: Denial of Service | 7.5 | |
| High | CVE-2021-33503 | Python urllib3: Denial of Service | 7.5 | |
| High | CVE-2019-11324 | Python urllib3: security vulnerability | 7.5 | |
| High | CVE-2025-66418 | urllib3 allows an unbounded number of links in the decompression chain | 7.5 | |
| Medium | CVE-2020-26137 | Python urllib3: CRLF Injection | 6.5 | |
| Medium | CVE-2021-28363 | Python urllib3: security vulnerability | 6.5 | |
| High | CVE-2026-44432 | urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API | 7.5 | |
| Medium | CVE-2019-11236 | Python urllib3: CRLF Injection | 6.1 | |
| High | CVE-2026-97689 | urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory | 7.5 | |
| High | CVE-2025-66471 | urllib3 Streaming API improperly handles highly compressed data | 7.5 | |
| High | CVE-2023-43804 | `Cookie` HTTP header isn't stripped on cross-origin redirects | 5.9 | |
| High | CVE-2026-97687 | urllib3: HTTPS proxy TLS configuration may be ignored or overridden | 8.1 | |
| Medium | CVE-2026-97688 | urllib3: Chunked Deflate streaming can enter an infinite loop | 5.3 | |
| High | CVE-2026-44431 | urllib3: Sensitive headers forwarded across origins in proxied low-level redirects | 5.3 | |
| Medium | CVE-2024-37891 | Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3 | 4.4 | |
| Medium | CVE-2025-50182 | urllib3 does not control redirects in browsers and Node.js | 5.3 | |
| Medium | CVE-2018-25091 | Python urllib3: security vulnerability | 6.1 | |
| Medium | CVE-2025-50181 | urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation | 5.3 | |
| Medium | CVE-2023-45803 | Request body not stripped after redirect in urllib3 | 4.2 | |
| Low | CVE-2016-9015 | Python urllib3: Information Disclosure | 3.7 |