CVE-2026-44431: Python URLLIB3

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.

Affected products

• Python URLLIB3: from 1.23, before 2.7.0 (fixed in 2.7.0)

Published 2026-05-13. Last modified 2026-06-26.