CVE-2021-28363: urllib3 - Default SSLContext Doesn't Verify Certificate Hostname for Proxy Connection
Summary
CVE-2021-28363: Impact Users who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via proxy_config. Affects urllib3 versions >= 1.26.0, < 1.26.4. Fixed in 1.26.4. How to fix ↓
Also tracked for
- py3-urllib3 · Alpine:v3.14
The same CVE-2021-28363 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a Python library that provides a high-level interface for making HTTP requests. It is commonly used for sending HTTP requests and handling responses in Python applications. This vulnerability affects urllib3 versions prior to 1.26.4. When using an HTTPS proxy to issue HTTPS requests without configuring a custom SSLContext, urllib3 relies on the default SSLContext, which does not verify the certificate hostname for the proxy connection.
Vulnerability Detail
The vulnerability arises when users utilize an HTTPS proxy to send HTTPS requests and have not configured their own SSLContext via proxy_config. Only the default SSLContext is affected. This means that the certificate hostname for the proxy connection is not properly verified, potentially allowing for man-in-the-middle attacks or other security breaches. The impact of this vulnerability is moderate.
How To Fix
Latest published version: 2.8.0 as of 23 Oct 2026
pip install --upgrade "urllib3==2.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.26.4
This is the first release that contains the fix.
pip install --upgrade "urllib3==1.26.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, users can implement a workaround by configuring a custom SSLContext with check_hostname=True and passing it via proxy_config. This ensures that the certificate hostname for the proxy connection is properly verified. Here is an example of how to implement this workaround:
import urllib3
ssl_context = urllib3.util.ssl_.create_urllib3_context(check_hostname=True)
proxy_config = urllib3.ProxyManager(proxy_url, ssl_context=ssl_context)
Conclusion
In conclusion, the vulnerability in urllib3 versions prior to 1.26.4 allows for the possibility of man-in-the-middle attacks or other security breaches when using an HTTPS proxy. It is recommended to upgrade to the latest version or implement the provided workaround to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for urllib3 →
FAQ
urllib3 is a Python library used for making HTTP requests and handling responses in Python applications.
urllib3 versions prior to 1.26.4 are affected by this vulnerability.
The impact of this vulnerability is moderate. It can potentially allow for man-in-the-middle attacks or other security breaches.
To fix this vulnerability, it is recommended to upgrade urllib3 to version 1.26.4 or newer. Alternatively, you can configure a custom SSLContext with check_hostname=True and pass it via proxy_config.
Yes, if upgrading is not immediately feasible, you can implement a workaround by configuring a custom SSLContext with check_hostname=True and passing it via proxy_config.
References
Related vulnerabilities
Recent vulnerabilities recorded for urllib3.
