Sign in
Deutsch English Español Polski
Medium

Improper Neutralization of CRLF Sequences in urllib3 library for Python

  • Disclosed: 15.04.2019
  • Updated: 11.10.2026 11:20

In the urllib3 library through 1.24.2 for Python, CRLF injection is possible if the attacker controls the request parameter.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) urllib3 < 1.24.3 1.24.3

References

CVSS score 6.1/10
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE)
CWE-93
Platform
Python (PyPI)
Package
urllib3
Disclosed
15.04.2019
Updated
11.10.2026 11:20

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2019-132 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-r64q-w8jr-g9qp - CC BY 4.0

Vulnerability history: urllib3

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (22) in the archive
Total entries
22
First → latest
01.2017 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 11
  • Medium 10

Disclosures per year

Severity:
  1. urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
    High CVE-2026-97689 >= 1.10.3, < 2.8.0 2.8.0
  2. urllib3: HTTPS proxy TLS configuration may be ignored or overridden
    High CVE-2026-97687 >= 1.26.0, < 2.8.0 2.8.0
  3. urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
    High · 7.5 CVE-2026-44432 >= 2.6.0, < 2.7.0 2.7.0
  4. urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
    High · 5.3 CVE-2026-44431 >= 1.23, < 2.7.0 2.7.0
  5. Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
    High · 7.5 CVE-2026-21441 >= 1.22, < 2.6.3 2.6.3
  6. urllib3 streaming API improperly handles highly compressed data
    High CVE-2025-66471 >= 1.0, < 2.6.0 2.6.0
  7. urllib3 allows an unbounded number of links in the decompression chain
    High CVE-2025-66418 >= 1.24, < 2.6.0 2.6.0
  8. `Cookie` HTTP header isn't stripped on cross-origin redirects
    High · 5.9 CVE-2023-43804 >= 2.0.0, < 2.0.6, < 1.26.17 2.0.6, 1.26.17
  9. Catastrophic backtracking in URL authority parser when passed URL containing many @ characters
    High · 7.5 CVE-2021-33503 >= 1.25.4, < 1.26.5 1.26.5
  10. Uncontrolled Resource Consumption in urllib3
    High · 7.5 CVE-2020-7212 >= 1.25.2, < 1.25.8 1.25.8
  11. Improper Certificate Validation in urllib3
    High · 7.5 CVE-2019-11324 < 1.24.2 1.24.2
  12. Improper Neutralization of CRLF Sequences in urllib3 library for Python this entry
    Medium · 6.1 CVE-2019-11236 < 1.24.3 1.24.3
  13. Exposure of Sensitive Information to an Unauthorized Actor in urllib3
    Critical · 9.8 CVE-2018-20060 < 1.23 1.23

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.