CVE-2021-28363Medium· 6.5▾ SunlitThe urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
2.1%
Last analysed / modified upstream
2.1% → 2.2%
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.
urllib3 >= 1.26.0, < 1.26.4fedora = 34peoplesoft_enterprise_peopletools = 8.59Upgrade past the affected range:
urllib3 1.26.4Affected packages:
urllib3 >= 1.26.0, < 1.26.4Patched in:
urllib3 1.26.4Connected by shared product, vendor, weakness, or advisory.
CVE-2021-33503High· 7.5An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the a…
CVE-2026-97687High· 8.1urllib3 is an HTTP client library for Python
CVE-2022-45061High· 7.5An issue was discovered in Python before 3.11.1
CVE-2022-0391High· 7.5A flaw was found in Python, specifically within the urllib.parse module
CVE-2021-28861High· 7.4Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure
CVE-2021-23336Medium· 5.9The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by usi…