Is urllib3 safe ? 22 known vulnerabilities, worst severity CRITICAL.
// reach 5 direct dependencies
3 carry known advisories, worst CRITICAL
705 packages depend on it
an advisory here reaches each of them
// ai model usage No published models are known to use this package.
cvss CVSS v3.0 base score out of 10
epss chance of exploitation in 30 days, 92nd percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-www2-v7xj-xrc6, the advisory selected below
// 22 advisories GHSA-www2-v7xj-xrc6 urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext. CRIT GHSA-vxq7-64xx-v4gw urllib3's streaming API is designed for efficiently handling large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When decoding a chunked-transfer-encoded response, this API reads each chunk's size field by buffering until it sees \n or EOF. HIGH GHSA-8988-9cw3-xx77 urllib3 supports configuring TLS independently for an HTTPS proxy and the target server. HIGH GHSA-mf9v-mfxr-j63j urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. HIGH GHSA-qccp-gfcp-xxvc When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as urllib3.request(), PoolManager.request(), and ProxyManager.request(), sensitive headers — Authorization, Cookie, and Proxy-Authorization (defined in Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT) — are stripped by default, as expected. HIGH GHSA-38jv-5279-wg99 urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. HIGH GHSA-2xpw-w6gg-jr37 urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. HIGH GHSA-gm62-xv2j-4w53 urllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, zstd). HIGH GHSA-v845-jxx5-vc9f urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. HIGH GHSA-q2q7-5pp4-w6pg When provided with a URL containing many @ characters in the authority component the authority regular expression exhibits catastrophic backtracking causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect. HIGH Show all 22 advisories urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.
// cvss v3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High Checked 2026-11-06 at 21:51 UTC. The most recent advisory here was published 2026-09-30. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page