Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/urllib3@2.7.0
Typepypi
Namespace
Nameurllib3
Version2.7.0
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_versionnull
Latest_non_vulnerable_versionnull
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-3wae-93ac-7qgn
vulnerability_id VCID-3wae-93ac-7qgn
summary urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.
references
0
reference_url https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j
fixed_packages
0
url pkg:pypi/urllib3@2.7.0
purl pkg:pypi/urllib3@2.7.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/urllib3@2.7.0
aliases CVE-2026-44432, GHSA-mf9v-mfxr-j63j, PYSEC-2026-142
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3wae-93ac-7qgn
1
url VCID-ueb4-ur9q-u3e1
vulnerability_id VCID-ueb4-ur9q-u3e1
summary urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
references
0
reference_url https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
url https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc
fixed_packages
0
url pkg:pypi/urllib3@2.7.0
purl pkg:pypi/urllib3@2.7.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/urllib3@2.7.0
aliases CVE-2026-44431, GHSA-qccp-gfcp-xxvc, PYSEC-2026-141
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ueb4-ur9q-u3e1
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/urllib3@2.7.0