CVE-2026-44431 - Medium Severity Vulnerability
Vulnerable Library - urllib3-2.6.3-py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260402140528_BYRDYW/python_TYRXAX/20260402140530/urllib3-2.6.3-py3-none-any.whl,/tmp/ws-ua_20260402140528_BYRDYW/python_TYRXAX/20260402140530/urllib3-2.6.3-py3-none-any.whl
Dependency Hierarchy:
- ❌ urllib3-2.6.3-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 733821ba208032bbe0d8b2992a2e4aece4265119
Found in base branch: main
Vulnerability Details
Impact When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as "urllib3.request()", "PoolManager.request()", and "ProxyManager.request()", sensitive headers — "Authorization", "Cookie", and "Proxy-Authorization" (defined in "Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT") — are stripped by default, as expected. However, cross-origin redirects followed from the low-level API via "ProxyManager.connection_from_url().urlopen(..., assert_same_host=False)" still forward these sensitive headers. Affected usage Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through "HTTPConnection.urlopen()" instances created via "ProxyManager.connection_from_url()". Remediation Upgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by "HTTPConnection". If upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to "ProxyManager.request()".
Publish Date: 2026-05-11
URL: CVE-2026-44431
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-qccp-gfcp-xxvc
Release Date: 2026-05-11
Fix Resolution: urllib3 - 2.7.0,urllib3 - 2.7.0
Step up your Open Source Security Game with Mend here
CVE-2026-44431 - Medium Severity Vulnerability
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260402140528_BYRDYW/python_TYRXAX/20260402140530/urllib3-2.6.3-py3-none-any.whl,/tmp/ws-ua_20260402140528_BYRDYW/python_TYRXAX/20260402140530/urllib3-2.6.3-py3-none-any.whl
Dependency Hierarchy:
Found in HEAD commit: 733821ba208032bbe0d8b2992a2e4aece4265119
Found in base branch: main
Impact When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as "urllib3.request()", "PoolManager.request()", and "ProxyManager.request()", sensitive headers — "Authorization", "Cookie", and "Proxy-Authorization" (defined in "Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT") — are stripped by default, as expected. However, cross-origin redirects followed from the low-level API via "ProxyManager.connection_from_url().urlopen(..., assert_same_host=False)" still forward these sensitive headers. Affected usage Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through "HTTPConnection.urlopen()" instances created via "ProxyManager.connection_from_url()". Remediation Upgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by "HTTPConnection". If upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to "ProxyManager.request()".
Publish Date: 2026-05-11
URL: CVE-2026-44431
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: GHSA-qccp-gfcp-xxvc
Release Date: 2026-05-11
Fix Resolution: urllib3 - 2.7.0,urllib3 - 2.7.0
Step up your Open Source Security Game with Mend here