Skip to content

GHSA-qccp-gfcp-xxvc on CTRL-OS 26.05

Aliases: GHSA-qccp-gfcp-xxvc, CVE-2026-44431

Packages: python3Packages.urllib3

Status: Plausible

Advisory Information

Impact

When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as urllib3.request(), PoolManager.request(), and ProxyManager.request(), sensitive headers — Authorization, Cookie, and Proxy-Authorization (defined in Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT) — are stripped by default, as expected.

However, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers.

Affected usage

Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through HTTPConnection.urlopen() instances created via ProxyManager.connection_from_url().

Remediation

Upgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by HTTPConnection.

If upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to ProxyManager.request().

Updates

2026-07-16 22:27 CEST

Metadata changes:

  • Status for package python3Packages.urllib3: “Plausible”

(Amended on: 2026-07-27 23:57 CEST)

2026-05-29 00:14 CEST

Metadata changes:

  • Status for package python3Packages.urllib3: “New”