CVE-2026-44431

Name	CVE-2026-44431
Description	urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1136653

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-urllib3 (PTS)	bullseye	1.26.5-1~exp1	vulnerable
	bullseye (security)	1.26.5-1~exp1+deb11u3	vulnerable
	bookworm	1.26.12-1+deb12u1	vulnerable
	bookworm (security)	1.26.12-1+deb12u3	vulnerable
	trixie (security), trixie	2.3.0-3+deb13u1	vulnerable
	forky, sid	2.6.3-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
python-urllib3	source	(unstable)	(unfixed)			1136653

https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc