StackPrism

PyPI package

urllib3 vulnerabilities by version

The latest release, 2.8.0 (Sep 15, 2026), has no known vulnerabilities. 9 of the 10 most recent releases have known vulnerabilities. OSV.dev lists 22 advisories for urllib3; the newest was published on Sep 30, 2026.

PyPI (opens in a new tab) describes it as “HTTP library with thread-safe connection pooling, file post, and more.”

Latest release
2.8.0
Sep 15, 2026, no known vulnerabilities
Downloads last week
341.6M
All versions, from pypistats.org
Advisories on OSV.dev
22
Newest Sep 30, 2026
Licence
MIT
OpenSSF Scorecard
8.6/10
urllib3/urllib3 (opens in a new tab)

Recent releases

PyPI doesn’t publish downloads per version, so these are the newest releases, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilities
2.8.0latestSep 15, 2026No known vulnerabilities
2.7.0May 7, 20263 known vulnerabilities, worst rated critical
2.6.3Jan 7, 20265 known vulnerabilities, worst rated critical
2.6.2Dec 11, 20256 known vulnerabilities, worst rated critical
2.6.1Dec 8, 20255 known vulnerabilities, worst rated critical
2.6.0Dec 5, 20255 known vulnerabilities, worst rated critical
2.5.0Jun 18, 20256 known vulnerabilities, worst rated critical
2.4.0Apr 10, 20258 known vulnerabilities, worst rated critical
2.3.0Dec 22, 20248 known vulnerabilities, worst rated critical
2.2.3Sep 12, 20248 known vulnerabilities, worst rated critical

Release lines

The newest release of each minor line, from the registry. urllib3 doesn’t publish support dates we can check.

LineNewest releaseReleased
2.82.8.0Sep 15, 2026
2.72.7.0May 7, 2026
2.62.6.3Jan 7, 2026
2.52.5.0Jun 18, 2025
2.42.4.0Apr 10, 2025
2.32.3.0Dec 22, 2024

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. WarningCVE-2026-97688 on OSV.dev (opens in a new tab)GHSA-gh4c-6fx4-qh6g

    urllib3: Chunked Deflate streaming can enter an infinite loop

    Affects >= 2.6.2, < 2.8.0. Published Sep 30, 2026.

  2. CriticalCVE-2026-97689 on OSV.dev (opens in a new tab)GHSA-vxq7-64xx-v4gw

    urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

    Affects >= 1.10.3, < 2.8.0. Published Sep 30, 2026.

  3. CriticalCVE-2026-97687 on OSV.dev (opens in a new tab)GHSA-8988-9cw3-xx77

    urllib3: HTTPS proxy TLS configuration may be ignored or overridden

    Affects >= 1.26.0, < 2.8.0. Published Sep 30, 2026.

  4. CriticalCVE-2026-44432 on OSV.dev (opens in a new tab)GHSA-mf9v-mfxr-j63j

    urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

    Affects >= 2.6.0, < 2.7.0. Published May 11, 2026.

  5. CriticalCVE-2026-44431 on OSV.dev (opens in a new tab)GHSA-qccp-gfcp-xxvc

    urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

    Affects >= 1.23, < 2.7.0. Published May 11, 2026.

All 22 advisories are on OSV.dev (opens in a new tab).

Which urllib3 do you have?

Paste a public GitHub repo or drop your requirements.txt or pyproject.toml and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for urllib3, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from pypistats.org. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, PyPI, pypistats.org and deps.dev.