urllib3 2.0.0a1 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the urllib3 package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Improper Handling of Highly Compressed Data (Data Amplification) urllib3 is a HTTP library with thread-safe connection pooling, file post, and more. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) in the Streaming API. The `ContentDecoder` class can be forced to allocate disproportionate resources when processing a single chunk with very high compression, such as via the `stream()`, `read(amt=256)`, `read1(amt=256)`, `read_chunked(amt=256)`, and `readinto(b)` functions. Note: It is recommended to patch Brotli dependencies (upgrade to at least 1.2.0) if they are installed outside of `urllib3` as well, to avoid other instances of the same vulnerability. How to fix Improper Handling of Highly Compressed Data (Data Amplification)? Upgrade `urllib3` to version 2.6.0 or higher.	[1.0,2.6.0)
H Allocation of Resources Without Limits or Throttling urllib3 is a HTTP library with thread-safe connection pooling, file post, and more. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling during the decompression of compressed response data. An attacker can cause excessive CPU and memory consumption by sending responses with a large number of chained compression steps. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `urllib3` to version 2.6.0 or higher.	[1.24,2.6.0)
M Open Redirect urllib3 is a HTTP library with thread-safe connection pooling, file post, and more. Affected versions of this package are vulnerable to Open Redirect due to the `retries` parameter being ignored during `PoolManager` instantiation. An attacker can access unintended resources or endpoints by leveraging automatic redirects when the application expects redirects to be disabled at the connection pool level. Note: `requests` and `botocore` users are not affected. How to fix Open Redirect? Upgrade `urllib3` to version 2.5.0 or higher.	[,2.5.0)
M Improper Removal of Sensitive Information Before Storage or Transfer urllib3 is a HTTP library with thread-safe connection pooling, file post, and more. Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer due to the improper handling of the `Proxy-Authorization` header during cross-origin redirects when `ProxyManager` is not in use. When the conditions below are met, including non-recommended configurations, the contents of this header can be sent in an automatic HTTP redirect. Notes: To be vulnerable, the application must be doing all of the following: Setting the `Proxy-Authorization` header without using urllib3's built-in proxy support. Not disabling HTTP redirects (e.g. with `redirects=False`) Either not using an HTTPS origin server, or having a proxy or target origin that redirects to a malicious origin. How to fix Improper Removal of Sensitive Information Before Storage or Transfer? Upgrade `urllib3` to version 1.26.19, 2.2.2 or higher.	[,1.26.19)[2.0.0a1,2.2.2)

Vulnerability

Vulnerable Version

Improper Handling of Highly Compressed Data (Data Amplification)

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) in the Streaming API. The ContentDecoder class can be forced to allocate disproportionate resources when processing a single chunk with very high compression, such as via the stream(), read(amt=256), read1(amt=256), read_chunked(amt=256), and readinto(b) functions.

Note: It is recommended to patch Brotli dependencies (upgrade to at least 1.2.0) if they are installed outside of urllib3 as well, to avoid other instances of the same vulnerability.

How to fix Improper Handling of Highly Compressed Data (Data Amplification)?

Upgrade urllib3 to version 2.6.0 or higher.

[1.0,2.6.0)

Allocation of Resources Without Limits or Throttling

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling during the decompression of compressed response data. An attacker can cause excessive CPU and memory consumption by sending responses with a large number of chained compression steps.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade urllib3 to version 2.6.0 or higher.

[1.24,2.6.0)

Open Redirect

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Open Redirect due to the retries parameter being ignored during PoolManager instantiation. An attacker can access unintended resources or endpoints by leveraging automatic redirects when the application expects redirects to be disabled at the connection pool level.

Note:

requests and botocore users are not affected.

How to fix Open Redirect?

Upgrade urllib3 to version 2.5.0 or higher.

[,2.5.0)

Improper Removal of Sensitive Information Before Storage or Transfer

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer due to the improper handling of the Proxy-Authorization header during cross-origin redirects when ProxyManager is not in use. When the conditions below are met, including non-recommended configurations, the contents of this header can be sent in an automatic HTTP redirect.

Notes:

To be vulnerable, the application must be doing all of the following:

Setting the Proxy-Authorization header without using urllib3's built-in proxy support.
Not disabling HTTP redirects (e.g. with redirects=False)
Either not using an HTTPS origin server, or having a proxy or target origin that redirects to a malicious origin.

How to fix Improper Removal of Sensitive Information Before Storage or Transfer?

Upgrade urllib3 to version 1.26.19, 2.2.2 or higher.

[,1.26.19)[2.0.0a1,2.2.2)

urllib3@2.0.0a1 vulnerabilities

HTTP library with thread-safe connection pooling, file post, and more.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically