CVE-2021-28363: urllib3 SSL Certificate Validation Bypass
Summary
CVE-2021-28363: The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. Affects urllib3 across 2 version ranges.
>= 1.26.0, < 1.26.4
< 8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0
Fixed in 8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0. How to fix ↓
Also tracked for
- py3-urllib3 · Alpine:v3.14
The same CVE-2021-28363 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a powerful HTTP client library for Python, widely used for making HTTP requests. It provides a high-level interface for sending HTTP requests, handling cookies, and managing connections. urllib3 is vulnerable to a SSL certificate validation bypass in versions 1.26.x before 1.26.4. This vulnerability occurs when making HTTPS requests through HTTPS proxies without explicitly providing an SSLContext. The initial connection to the HTTPS proxy does not verify the hostname of the certificate, allowing certificates for different servers to be silently accepted.
Vulnerability Detail
The vulnerability in urllib3 allows for the acceptance of certificates from different servers that still validate properly with the default urllib3 SSLContext. This means that an attacker could potentially present a valid certificate for a different server, leading to a man-in-the-middle attack or other security breaches. The lack of hostname verification during the initial connection to the HTTPS proxy exposes users to potential risks and compromises the integrity and security of the communication.
How To Fix
Latest published version: 2.8.0 as of 23 Oct 2026
pip install --upgrade "urllib3==2.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0
This is the first release that contains the fix.
pip install --upgrade "urllib3==8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading urllib3 is not immediately possible, a workaround is to explicitly provide an SSLContext when making HTTPS requests through HTTPS proxies. This can be achieved by modifying the code to include the following:
import urllib3
proxy_config = urllib3.ProxyManager(proxy_url, proxy_config={'https': 'https_proxy_url'}, cert_reqs='CERT_REQUIRED', ca_certs='path_to_ca_certs_file')
This ensures that the hostname of the certificate is properly verified during the initial connection to the HTTPS proxy.
Conclusion
The urllib3 library is vulnerable to a SSL certificate validation bypass, which can lead to potential security risks and compromises. It is crucial to upgrade urllib3 to version 1.26.4 or later to mitigate this vulnerability. Alternatively, you can implement the provided workaround by explicitly providing an SSLContext when making HTTPS requests through HTTPS proxies. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for urllib3 →
FAQ
urllib3 is a Python library used for making HTTP requests. It provides a high-level interface for sending HTTP requests, handling cookies, and managing connections.
This vulnerability allows for the acceptance of certificates from different servers, potentially leading to man-in-the-middle attacks or other security breaches.
To fix this vulnerability, it is recommended to upgrade urllib3 to version 1.26.4 or later.
Yes, a workaround is to explicitly provide an SSLContext when making HTTPS requests through HTTPS proxies.
If your application uses urllib3 to make HTTPS requests through HTTPS proxies without explicitly providing an SSLContext, it may be vulnerable to this issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for urllib3.
