Known Vulnerabilities for Urllib3 by Python

Listed below are 8 of the newest known vulnerabilities associated with "Urllib3" by "Python".

These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.

Data on known vulnerable versions is also displayed based on information from known CPEs

Known Vulnerabilities

CVE Shortened Description Severity Publish Date Last Modified
CVE-2021-33503 An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority comp... 7.5 - HIGH 2021-06-29 2023-11-07
CVE-2021-28363 The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS p... 6.5 - MEDIUM 2021-03-15 2023-11-07
CVE-2020-26137 urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR... 6.5 - MEDIUM 2020-09-30 2023-10-08
CVE-2020-7212 The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of ... 7.5 - HIGH 2020-03-06 2020-03-09
CVE-2019-11324 The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different f... 7.5 - HIGH 2019-04-18 2023-11-07
CVE-2019-11236 In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. 6.1 - MEDIUM 2019-04-15 2023-11-07
CVE-2018-20060 urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a red... 9.8 - CRITICAL 2018-12-11 2023-11-07
CVE-2016-9015 Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configuratio... 3.7 - LOW 2017-01-11 2017-01-13

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
ApplicationPythonUrllib31.9.1AllAllAll
ApplicationPythonUrllib31.9AllAllAll
ApplicationPythonUrllib31.8.3AllAllAll
ApplicationPythonUrllib31.8.2AllAllAll
ApplicationPythonUrllib31.8.1AllAllAll
ApplicationPythonUrllib31.8AllAllAll
ApplicationPythonUrllib31.7.1AllAllAll
ApplicationPythonUrllib31.7AllAllAll
ApplicationPythonUrllib31.6AllAllAll
ApplicationPythonUrllib31.5AllAllAll
ApplicationPythonUrllib31.4AllAllAll
ApplicationPythonUrllib31.3AllAllAll
ApplicationPythonUrllib31.25.9AllAllAll
ApplicationPythonUrllib31.25.8AllAllAll
ApplicationPythonUrllib31.25.7AllAllAll
ApplicationPythonUrllib31.25.6AllAllAll
ApplicationPythonUrllib31.25.5AllAllAll
ApplicationPythonUrllib31.25.4AllAllAll
ApplicationPythonUrllib31.25.3AllAllAll
ApplicationPythonUrllib31.25.2AllAllAll
Results limited to 20 most recent known configurations
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report