CVE-2026-44431 - Medium Severity Vulnerability
Vulnerable Library - urllib3-1.25.10-py2.py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/9f/f0/a391d1463ebb1b233795cabfc0ef38d3db4442339de68f847026199e69d7/urllib3-1.25.10-py2.py3-none-any.whl
Path to dependency file: /day70/requirements.txt
Path to vulnerable library: /day70/requirements.txt
Dependency Hierarchy:
- ❌ urllib3-1.25.10-py2.py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: c88b9429eb68a85b22f0e39cac7bf20b89cb6709
Found in base branch: master
Vulnerability Details
Impact When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as "urllib3.request()", "PoolManager.request()", and "ProxyManager.request()", sensitive headers — "Authorization", "Cookie", and "Proxy-Authorization" (defined in "Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT") — are stripped by default, as expected. However, cross-origin redirects followed from the low-level API via "ProxyManager.connection_from_url().urlopen(..., assert_same_host=False)" still forward these sensitive headers. Affected usage Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through "HTTPConnection.urlopen()" instances created via "ProxyManager.connection_from_url()". Remediation Upgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by "HTTPConnection". If upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to "ProxyManager.request()".
Publish Date: 2026-05-12
URL: CVE-2026-44431
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-qccp-gfcp-xxvc
Release Date: 2026-05-11
Fix Resolution: 2.7.0
Step up your Open Source Security Game with Mend here
CVE-2026-44431 - Medium Severity Vulnerability
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/9f/f0/a391d1463ebb1b233795cabfc0ef38d3db4442339de68f847026199e69d7/urllib3-1.25.10-py2.py3-none-any.whl
Path to dependency file: /day70/requirements.txt
Path to vulnerable library: /day70/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: c88b9429eb68a85b22f0e39cac7bf20b89cb6709
Found in base branch: master
Impact When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as "urllib3.request()", "PoolManager.request()", and "ProxyManager.request()", sensitive headers — "Authorization", "Cookie", and "Proxy-Authorization" (defined in "Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT") — are stripped by default, as expected. However, cross-origin redirects followed from the low-level API via "ProxyManager.connection_from_url().urlopen(..., assert_same_host=False)" still forward these sensitive headers. Affected usage Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through "HTTPConnection.urlopen()" instances created via "ProxyManager.connection_from_url()". Remediation Upgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by "HTTPConnection". If upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to "ProxyManager.request()".
Publish Date: 2026-05-12
URL: CVE-2026-44431
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: GHSA-qccp-gfcp-xxvc
Release Date: 2026-05-11
Fix Resolution: 2.7.0
Step up your Open Source Security Game with Mend here