Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,183
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

12 advisories

Loading
urllib3: Chunked Deflate streaming can enter an infinite loop Moderate
CVE-2026-97688 was published for urllib3 (pip) Sep 30, 2026
gnuletik Credited to gnuletik, illia-v, and pquentin illia-v illia-v
pquentin pquentin
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory High
CVE-2026-97689 was published for urllib3 (pip) Sep 30, 2026
pquentin Credited to pquentin and illia-v illia-v illia-v
urllib3: HTTPS proxy TLS configuration may be ignored or overridden High
CVE-2026-97687 was published for urllib3 (pip) Sep 30, 2026
dhoepp Credited to dhoepp, shazow, fuyu0425, sethmlarson, illia-v, yonatanmgr, and pquentin shazow shazow
fuyu0425 fuyu0425 sethmlarson sethmlarson illia-v illia-v yonatanmgr yonatanmgr pquentin pquentin
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API High
CVE-2026-44432 was published for urllib3 (pip) May 11, 2026
kimkou2024 Credited to kimkou2024, Cycloctane, illia-v, and pquentin Cycloctane Cycloctane
illia-v illia-v pquentin pquentin
Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) High
CVE-2026-21441 was published for urllib3 (pip) Jan 7, 2026
D47A Credited to D47A, illia-v, pquentin, and sethmlarson illia-v illia-v
pquentin pquentin sethmlarson sethmlarson
urllib3 streaming API improperly handles highly compressed data High
CVE-2025-66471 was published for urllib3 (pip) Dec 5, 2025
illia-v Credited to illia-v, pquentin, sethmlarson, Cycloctane, stamparm, and Chi-Song-Owen pquentin pquentin
sethmlarson sethmlarson Cycloctane Cycloctane stamparm stamparm Chi-Song-Owen Chi-Song-Owen
urllib3 allows an unbounded number of links in the decompression chain High
CVE-2025-66418 was published for urllib3 (pip) Dec 5, 2025
illia-v Credited to illia-v, sethmlarson, and pquentin sethmlarson sethmlarson
pquentin pquentin
urllib3 does not control redirects in browsers and Node.js Moderate
CVE-2025-50182 was published for urllib3 (pip) Jun 18, 2025
illia-v Credited to illia-v, pquentin, and sethmlarson pquentin pquentin
sethmlarson sethmlarson
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation Moderate
CVE-2025-50181 was published for urllib3 (pip) Jun 18, 2025
sandumjacob Credited to sandumjacob, illia-v, pquentin, and sethmlarson illia-v illia-v
pquentin pquentin sethmlarson sethmlarson
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects Moderate
CVE-2024-37891 was published for urllib3 (pip) Jun 17, 2024
pquentin Credited to pquentin, illia-v, and G-Rath illia-v illia-v
G-Rath G-Rath
`Cookie` HTTP header isn't stripped on cross-origin redirects High
CVE-2023-43804 was published for urllib3 (pip) Oct 2, 2023
ranjit-git Credited to ranjit-git, pquentin, illia-v, and sethmlarson pquentin pquentin
illia-v illia-v sethmlarson sethmlarson
Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection Moderate
CVE-2021-28363 was published for urllib3 (pip) Mar 19, 2021
jalopezsilva Credited to jalopezsilva and pquentin pquentin pquentin
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database