Patchfirst
Patchfirst
Chainurllib3PyPI:urllib3

urllib3: incomplete fixes (2018–2025)

7 CVEs over 4 generations, 11 Dec 2018 to 19 Jun 2025.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2018-2006011 Dec 2018 First in the chain
  2. CVE-2019-1132418 Apr 2019 next fix after CVE-2018-20060
  3. CVE-2020-72126 Mar 2020 No direct link to an earlier CVE
  4. CVE-2021-3350329 Jun 2021 related to CVE-2019-11324related to CVE-2020-7212
  5. CVE-2018-2509115 Oct 2023 incomplete fix for CVE-2018-20060related to CVE-2019-11324
  6. CVE-2023-4580317 Oct 2023 related to CVE-2019-11324related to CVE-2021-33503and 1 more
  7. CVE-2025-5018119 Jun 2025 related to CVE-2019-11324related to CVE-2018-25091and 1 more
2018202020212022202320242025 CVE-2018-20060 → CVE-2018-25091: incomplete fix (high confidence)CVE-2019-11324 → CVE-2018-25091: related (medium confidence)CVE-2019-11324 → CVE-2021-33503: related (medium confidence)CVE-2019-11324 → CVE-2023-45803: related (medium confidence)CVE-2019-11324 → CVE-2025-50181: related (medium confidence)CVE-2020-7212 → CVE-2021-33503: related (medium confidence)CVE-2021-33503 → CVE-2023-45803: related (medium confidence)CVE-2018-25091 → CVE-2023-45803: related (medium confidence)CVE-2018-25091 → CVE-2025-50181: related (medium confidence)CVE-2023-45803 → CVE-2025-50181: related (medium confidence)CVE-2018-20060 → CVE-2019-11324: Next fix in the same package (low confidence) CVE-2018-20060 11 Dec 2018 CVE-2019-11324 18 Apr 2019 CVE-2020-7212 6 Mar 2020 CVE-2021-33503 29 Jun 2021 CVE-2018-25091 15 Oct 2023 CVE-2023-45803 17 Oct 2023 CVE-2025-50181 19 Jun 2025 20182019202020212022202320242025 CVE-2018-20060 → CVE-2018-25091: incomplete fix (high confidence)CVE-2019-11324 → CVE-2018-25091: related (medium confidence)CVE-2019-11324 → CVE-2021-33503: related (medium confidence)CVE-2019-11324 → CVE-2023-45803: related (medium confidence)CVE-2019-11324 → CVE-2025-50181: related (medium confidence)CVE-2020-7212 → CVE-2021-33503: related (medium confidence)CVE-2021-33503 → CVE-2023-45803: related (medium confidence)CVE-2018-25091 → CVE-2023-45803: related (medium confidence)CVE-2018-25091 → CVE-2025-50181: related (medium confidence)CVE-2023-45803 → CVE-2025-50181: related (medium confidence)CVE-2018-20060 → CVE-2019-11324: Next fix in the same package (low confidence) CVE-2018-20060 11 Dec 2018 CVE-2019-11324 18 Apr 2019 CVE-2020-7212 6 Mar 2020 CVE-2021-33503 29 Jun 2021 CVE-2018-25091 15 Oct 2023 CVE-2023-45803 17 Oct 2023 CVE-2025-50181 19 Jun 2025
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2018-20060 11 Dec 2018 urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect… · fixed in 1.23 First in chain 18.3
CVE-2019-11324 18 Apr 2019 The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is… · fixed in 1.24.2 CVE-2018-20060 · Next fix in the same package · Low 17.4
CVE-2020-7212 6 Mar 2020 The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a… · fixed in 1.25.8 First in chain 17.7
CVE-2021-33503 29 Jun 2021 An issue was discovered in urllib3 before 1.26.5 · fixed in 1.26.5 CVE-2019-11324 · related · Medium 17.7
CVE-2018-25091 15 Oct 2023 urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a… · fixed in 1.24.2 CVE-2018-20060 · incomplete fix · High 9.7
CVE-2023-45803 17 Oct 2023 Request body not stripped after redirect in urllib3 · fixed in 2.0.7 CVE-2019-11324 · related · Medium 12.6
CVE-2025-50181 19 Jun 2025 urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation · fixed in 2.5.0 CVE-2019-11324 · related · Medium 11.9
↑ ↓ chooseEnter openEsc close