urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
CVSS Details
- CVSS 4.0 Base Score: 8.2 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fence-agents-cisco-mdsUpgrade fence-agents-sbdUpgrade fence-agents-virshUpgrade fence-agents-intelmodularUpgrade fence-agents-rhevmUpgrade fence-agents-bladecenterUpgrade fence-agents-computeUpgrade fence-agents-emersonUpgrade fence-agents-ipduUpgrade fence-agents-ilo-sshUpgrade fence-agents-gceUpgrade fence-agents-rsbUpgrade fence-agents-apc-snmpUpgrade resource-agents-gcpUpgrade fence-agents-vmware-soapUpgrade fence-agents-commonUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-ipmilanUpgrade fence-agents-ifmibUpgrade fence-agents-aliyunUpgrade fence-agents-amt-wsUpgrade fence-agents-scsiUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-eaton-snmpUpgrade resource-agentsUpgrade fence-agents-ilo-mpUpgrade fence-agents-epsUpgrade fence-agents-brocadeUpgrade fence-agents-kdumpUpgrade fence-agents-azure-armUpgrade fence-agents-allUpgrade fence-agents-ibm-powervsUpgrade fence-agents-zvmUpgrade fence-agents-kubevirtUpgrade fence-agents-awsUpgrade resource-agents-aliyunUpgrade resource-agents-pafUpgrade fence-agents-redfishUpgrade fence-agents-cisco-ucsUpgrade fence-agents-hpbladeUpgrade fence-agents-heuristics-pingUpgrade fence-agents-ilo2Upgrade fence-agents-wtiUpgrade fence-agents-mpathUpgrade fence-agents-ibm-vpcUpgrade fence-agents-openstackUpgrade fence-agents-lparUpgrade fence-agents-ibmbladeUpgrade fence-agents-apcUpgrade fence-agents-rsaUpgrade fence-agents-drac5Upgrade python3.14-urllib3Upgrade python3.12-urllib3Upgrade python3-urllib3Upgrade fence-agents-vmware-rest | Jun 25, 2026 | Jun 23, 2026 |
| Amazon Linux Ami 2 | — | Upgrade python-urllib3Upgrade python3-urllib3 | Jun 23, 2026 | Jun 23, 2026 |
| Debian | — | Upgrade python-urllib3 | Jun 28, 2026 | Jun 28, 2026 |
| Redhat_linux | — | Upgrade fence-agents-intelmodularUpgrade fence-agents-amt-wsUpgrade fence-agents-azure-armUpgrade fence-agents-bladecenterUpgrade python3-urllib3Upgrade fence-agents-scsiUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-kdumpUpgrade resource-agentsUpgrade fence-agents-azure-arm-debuginfoUpgrade fence-agents-ipduUpgrade fence-agents-mpathUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-agents-allUpgrade fence-agents-epsUpgrade fence-agents-ilo-mpUpgrade fence-agents-aliyun-debuginfoUpgrade fence-agents-aliyunUpgrade fence-agents-computeUpgrade fence-agents-emersonUpgrade fence-agents-commonUpgrade fence-agents-ibm-powervsUpgrade fence-agents-rhevmUpgrade fence-agents-vmware-soapUpgrade fence-agents-cisco-mdsUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-ibmbladeUpgrade fence-agents-debuginfoUpgrade fence-agents-virshUpgrade fence-agents-eaton-snmpUpgrade fence-agents-rsbUpgrade fence-agents-sbdUpgrade fence-agents-apc-snmpUpgrade fence-agents-lparUpgrade resource-agents-aliyunUpgrade fence-agents-drac5Upgrade fence-agents-ilo2Upgrade fence-agents-brocadeUpgrade fence-agents-ilo-sshUpgrade fence-agents-kdump-debuginfoUpgrade fence-agents-debugsourceUpgrade fence-agents-apcUpgrade python3.12-urllib3Upgrade fence-agents-redfishUpgrade fence-agents-rsaUpgrade fence-agents-zvmUpgrade fence-agents-cisco-ucsUpgrade fence-agents-heuristics-pingUpgrade resource-agents-pafUpgrade fence-agents-vmware-restUpgrade fence-agents-ibm-vpcNo solution existsUpgrade fence-agents-kubevirtUpgrade resource-agents-debugsourceUpgrade resource-agents-aliyun-debuginfoUpgrade fence-agents-openstackUpgrade fence-agents-hpbladeUpgrade fence-agents-wtiUpgrade fence-agents-gceUpgrade resource-agents-gcpUpgrade fence-agents-ifmibUpgrade fence-agents-ipmilanUpgrade fence-agents-awsUpgrade resource-agents-debuginfoUpgrade python3.14-urllib3 | Jun 24, 2026 | May 13, 2026 |
| Rocky_linux | — | Upgrade fence-agents-kdumpUpgrade resource-agents-debugsourceUpgrade fence-agents-aliyunUpgrade resource-agents-gcpUpgrade fence-agents-allUpgrade fence-agents-azure-armUpgrade fence-agents-kdump-debuginfoUpgrade resource-agents-aliyun-debuginfoUpgrade fence-agents-redfishUpgrade fence-agents-azure-arm-debuginfoUpgrade resource-agents-debuginfoUpgrade resource-agentsUpgrade fence-agents-openstackUpgrade resource-agents-aliyunUpgrade fence-agents-kubevirt-debuginfoUpgrade resource-agents-pafUpgrade fence-agents-debugsourceUpgrade fence-agents-kubevirtUpgrade fence-agents-debuginfoUpgrade fence-agents-aliyun-debuginfo | Aug 7, 2026 | Aug 6, 2026 |
| Ubuntu | — | Upgrade python3-urllib3Upgrade python-urllib3 (Ubuntu Pro)Upgrade python3-urllib3 (Ubuntu Pro) | Jun 4, 2026 | Jun 3, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub