CVE-2026-44431Medium· 5.3▾ TwilightPoC availableurllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive hea…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.3%
Exploit / PoC code exists
urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
urllib3 >= 1.23, < 2.7.0Patched in:
urllib3 2.7.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-37891Medium· 4.4urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891)
CVE-2026-57231High· 7.5podman: Podman: Information disclosure via malicious container image environment variables (CVE-2026-57231)
CVE-2025-47273High· 7.1setuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273)
CVE-2026-116190Low· 3.7github.com/rclone/rclone: rclone: Information disclosure via cross-host HTTP redirects (CVE-2026-116190)
CVE-2026-111943Medium· 6.8crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
CVE-2024-53899High· 7.8virtualenv: potential command injection via virtual environment activation scripts (CVE-2024-53899)