CVE-2026-44431 Details
Description
urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
A vulnerability in urllib3, an HTTP client library for Python, allows sensitive headers to be forwarded across origins during cross-origin redirects. This issue affects urllib3 versions 1.23 through prior to 2.7.0, specifically when using the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False). In this scenario, headers such as Authorization, Cookie, and Proxy-Authorization are not stripped as they should be, potentially exposing sensitive information.
Users can upgrade to urllib3 version 2.7.0 or later, where this vulnerability is fixed. If an immediate upgrade is not possible, it is recommended to avoid using the low-level redirect flow for cross-origin redirects and, if appropriate, switch to using ProxyManager.request()
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2026/06/msg00040.html | CVE | |
| https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| python urllib3 | >= 1.23, < 2.7.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | CVE Modified | CVE |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |