Security

Report a vulnerability

.github/SECURITY.md

Security Disclosures

To report a security vulnerability, please use the Tidelift security contact. Tidelift will coordinate the fix and disclosure with maintainers.

Proxy-Authorization request header isn't stripped during cross-origin redirects
GHSA-34jh-p97f-mpxf published Jun 17, 2024 by sethmlarson

Moderate
Request body not stripped after redirect from 303 status changes request method to GET
GHSA-g4mx-q9vg-27p4 published Oct 17, 2023 by sethmlarson

Moderate
Cookie request header isn't stripped during cross-origin redirects
GHSA-v845-jxx5-vc9f published Oct 2, 2023 by sethmlarson

Moderate
Catastrophic backtracking in URL authority parser when passed URL containing many @ characters
GHSA-q2q7-5pp4-w6pg published May 26, 2021 by sethmlarson

Moderate
Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection
GHSA-5phf-pp7p-vc2r published Mar 15, 2021 by sethmlarson

High

Learn more about advisories related to urllib3/urllib3 in the GitHub Advisory Database