CVE-2026-44431

Katalog CVE

CVSS 5.3 · Medium EPSS 0,34%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada python urllib3. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.

Rincian

Terbit di NVD

13 Mei 2026

Terakhir diubah

26 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc mitigasi · advisory vendor
• https://lists.debian.org/debian-lts-announce/2026/06/msg00040.html