VIR Vulnerability Intelligence Relay

CVE-2026-44431

medium
Published 2026-05-13 · Modified 2026-05-20
CVSS v3
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v2
—
VIR risk
5.3

Description

urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.

Predictions

Exploit likelihood
63%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2026-44431

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2026-44431.html

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc

OS impact
OSVersionStatusFixed in
suse slesaffected
debian debianbookwormaffected
debian debianbullseyeaffected
debian debianforkyaffected
debian debiansidaffected
debian debiantrixieaffected

Package impact
EcosystemPackageVulnerableFixed
python PyPIurllib3>=1.23,<2.7.02.7.0
PIPurllib3>= 1.23, < 2.7.02.7.0

Application impact
VendorProductVersionsFixed
pythonurllib3{"startIncluding":"1.23","endExcluding":"2.7.0"}2.7.0
gcp googlegcp

References

CWEs

CWE-200

Verify integrity in audit chain (admin only). AS-IS.