CVE-2023-43804mediumCWE-200

CVE-2023-43804: falha de média gravidade em urllib3

`Cookie` HTTP header isn't stripped on cross-origin redirects

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar urllib3+ Monitorar python-urllib3

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.9epss 1.4%
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
urllib3 · urllib3
CVEs relacionadas — urllib3

No mesmo produto, das mais perigosas para as menos.

CVE-2026-21441HIGHurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)EPSS 2.9%CVE-2024-37891MEDIUMProxy-Authorization request header isn't stripped during cross-origin redirects in urllib3EPSS 1.1%CVE-2025-66471HIGHurllib3 Streaming API improperly handles highly compressed dataEPSS 0.7%CVE-2025-66418HIGHurllib3 allows an unbounded number of links in the decompression chainEPSS 0.7%CVE-2026-44432HIGHurllib3: Decompression-bomb safeguards bypassed in parts of the streaming APIEPSS 0.7%CVE-2025-50182MEDIUMurllib3 does not control redirects in browsers and Node.jsEPSS 0.6%