CVE-2023-43804: Debian Linux

High severity, CVSS 8.1. EPSS: 1.4% chance of exploitation in the next 30 days.

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 37 only; version 38 only; version 39 only
• Python URLLIB3: before 1.26.17 (fixed in 1.26.17); from 2.0.0, before 2.0.6 (fixed in 2.0.6)

Published 2023-10-04. Last modified 2026-06-17.