Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

urllib3 — Vulnerabilities & Security Advisories 13

All 13 CVE vulnerabilities found in urllib3, with AI-generated Chinese analysis, references, and POCs.

Vendor: urllib3

CVE ID Title CVSS Severity Published
CVE-2026-97689 urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory CWE-770 8.9 High 2026-09-29
CVE-2026-97688 urllib3: Chunked Deflate streaming can enter an infinite loop CWE-835 6.9 Medium 2026-09-29
CVE-2026-97687 urllib3: HTTPS proxy TLS configuration may be ignored or overridden CWE-295 7.6 High 2026-09-29
CVE-2026-44431 urllib3: Sensitive headers forwarded across origins in proxied low-level redirects CWE-200 - - 2026-05-13
CVE-2026-44432 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API CWE-409 8.9 High 2026-05-13
CVE-2026-21441 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CWE-409 8.9 High 2026-01-07
CVE-2025-66471 urllib3 Streaming API improperly handles highly compressed data CWE-409 9.8 - 2025-12-05
CVE-2025-66418 urllib3 allows an unbounded number of links in the decompression chain CWE-770 7.5 - 2025-12-05
CVE-2025-50182 urllib3 does not control redirects in browsers and Node.js CWE-601 5.3 Medium 2025-06-19
CVE-2025-50181 urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation CWE-601 5.3 Medium 2025-06-19
CVE-2024-37891 Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3 CWE-669 4.4 Medium 2024-06-17
CVE-2023-45803 Request body not stripped after redirect in urllib3 CWE-200 4.2 Medium 2023-10-17
CVE-2023-43804 `Cookie` HTTP header isn't stripped on cross-origin redirects CWE-200 5.9 Medium 2023-10-04

All 13 known CVE vulnerabilities affecting urllib3 with full Chinese analysis, references, and POCs where available.