CVE-2019-11324: urllib3 - SSL Verification Bypass
Summary
CVE-2019-11324: The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations... Affects urllib3 versions < 1.24.2. Fixed in 1.24.2. How to fix ↓
Also tracked for
- python-urllib3 · Debian:11
The same CVE-2019-11324 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a powerful HTTP client library for Python, widely used for making HTTP requests. It provides a high-level interface for handling various aspects of HTTP, including connection pooling, SSL/TLS verification, and more. However, versions prior to 1.24.2 mishandle certain cases where the desired set of CA certificates differs from the OS store of CA certificates. This can lead to SSL connections succeeding even when a verification failure is the correct outcome.
Vulnerability Detail
The vulnerability in urllib3 arises from the mishandling of SSL verification. When the desired set of CA certificates is different from the OS store of CA certificates, SSL connections may succeed even in situations where a verification failure should occur. This can result in the establishment of insecure connections, allowing attackers to intercept or modify sensitive data transmitted over the network. The issue is related to the usage of the ssl_context, ca_certs, or ca_certs_dir argument.
How To Fix
Latest published version: 2.8.0 as of 23 Oct 2026
pip install --upgrade "urllib3==2.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.24.2
This is the first release that contains the fix.
pip install --upgrade "urllib3==1.24.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading urllib3 is not immediately feasible, a possible workaround is to manually verify SSL certificates in your code. This involves explicitly specifying the CA certificates to be used for verification, rather than relying on the OS store. Here's an example of how to do this using the requests library, which internally uses urllib3:
import requests
Specify the path to the CA certificates file
ca_certs_path = '/path/to/ca_certs.pem'
Create a session with custom SSL verification
session = requests.Session() session.verify = ca_certs_path
Make requests using the session
response = session.get('https://example.com')
Process the response as needed
Conclusion
The urllib3 library for Python versions prior to 1.24.2 is vulnerable to SSL verification bypass. This can result in the establishment of insecure connections, potentially exposing sensitive data to attackers. It is recommended to upgrade urllib3 to version 1.24.2 or later to fix this vulnerability. If immediate upgrade is not feasible, manually verifying SSL certificates in your code can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for urllib3 →
FAQ
urllib3 is a Python library for making HTTP requests. It provides a high-level interface for handling various aspects of HTTP, including connection pooling, SSL/TLS verification, and more.
SSL verification is the process of verifying the authenticity of SSL certificates presented by servers during an SSL/TLS handshake. It ensures that the server is trusted and the connection is secure.
This vulnerability can lead to the establishment of insecure SSL connections, allowing attackers to intercept or modify sensitive data transmitted over the network.
To fix this vulnerability, upgrade urllib3 to version 1.24.2 or later. Alternatively, you can manually verify SSL certificates in your code.
Yes, a possible workaround is to manually verify SSL certificates in your code by explicitly specifying the CA certificates to be used for verification.
Related vulnerabilities
Recent vulnerabilities recorded for urllib3.
