Urllib3 vulnerabilitiesRanked by how likely they are to be used.
Urllib3 is made by Python. We track 12 published vulnerabilities in it, across 71 versions. None of them is on the list of flaws known to be exploited today. If you run Urllib3, keep it on a version the vendor still supports.
We keep watching the known-exploited list.
Which Urllib3 vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Urllib3's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Urllib3 flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 4.5%CVE-2018-20060Critical
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme).
- 3.4%CVE-2020-7212High
The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm.
- 3.3%CVE-2021-33503High
An issue was discovered in urllib3 before 1.26.5.
- 2.9%CVE-2019-11324High
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in...
- 2.3%CVE-2020-26137Medium
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest().
- 2.2%CVE-2021-28363Medium
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies.
- 2.1%CVE-2019-11236Medium
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
- 1.4%CVE-2023-43804Medium
urllib3 is a user-friendly HTTP client library for Python.
- 0.8%
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates.
- 0.6%CVE-2018-25091Medium
urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme).
Running Urllib3? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.
- Matched to
- Urllib3 on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 12 published vulnerabilities listed under the name Urllib3, across 71 versions.
None of Urllib3's vulnerabilities is on the list of flaws known to be exploited today.
Create a Precursor Intelligence account and track Urllib3. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.