Vulnerability in urllib3: urllib3's request body not stripped after redirect from 303 status changes request method to GET
Summary
CVE-2023-45803: urllib3's request body not stripped after redirect from 303 status changes request method to GET. Affects urllib3 across 2 version ranges.
< 1.26.18
>= 2.0.0, < 2.0.7
Fixed in 1.26.18 or 2.0.7, depending on the release line you run. How to fix ↓
Also tracked for
- py3-urllib3 · Alpine:v3.15
The same CVE-2023-45803 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a Python library that provides a high-level interface for making HTTP requests. It is commonly used in Python applications to handle network communication. This vulnerability affects urllib3 versions 0 to 2.0.6 and 1.26.17, and it involves the mishandling of HTTP request bodies after a redirect from a 303 status code to a GET request. This can potentially lead to the exposure of sensitive information if the request body contains confidential data.
Vulnerability Detail
The vulnerability arises when urllib3 fails to remove the HTTP request body after a redirect from a 303 status code to a GET request. According to the HTTP RFCs, a client should not generate content in a GET request unless explicitly supported by the server. However, urllib3 did not strip the request body in this scenario. While the exploitability of this vulnerability is low, it can have an impact on confidentiality if sensitive information is included in the request body. To mitigate this vulnerability, users are advised to upgrade to a patched version of urllib3 (v1.26.18 or v2.0.7) or disable redirects for services that are not expected to respond with redirects.
How To Fix
Latest published version: 2.8.0 as of 23 Oct 2026
pip install --upgrade "urllib3==2.8.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.26.181.26.18pip install --upgrade "urllib3==1.26.18" -
>= 2.0.0, < 2.0.72.0.7pip install --upgrade "urllib3==2.0.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to immediately upgrade urllib3 or disable redirects, you can manually handle 303 redirects by stripping the HTTP request body. Here is an example of how to do this in Python:
import urllib3
http = urllib3.PoolManager(redirects=False)
response = http.request('POST', 'https://example.com', body='data')
if response.status == 303:
response.release_conn()
response = http.request('GET', response.headers['location'])
# Continue processing the response
Conclusion
The vulnerability in urllib3's handling of redirects from a 303 status code to a GET request can potentially expose sensitive information included in the request body. Users are advised to upgrade to a patched version of urllib3 or take appropriate measures to disable redirects. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for urllib3 →
FAQ
urllib3 is a Python library that provides a high-level interface for making HTTP requests. It is commonly used in Python applications to handle network communication.
This vulnerability affects urllib3 versions 0 to 2.0.6 and 1.26.17.
The impact of this vulnerability is low as it requires a compromised origin service and the inclusion of sensitive information in the HTTP request body. However, if these conditions are met, it can lead to the exposure of confidential data.
You can fix this vulnerability by upgrading urllib3 to a patched version (v1.26.18 or v2.0.7) or by disabling redirects for services that are not expected to respond with redirects.
Yes, if you are unable to immediately upgrade urllib3 or disable redirects, you can manually handle 303 redirects by stripping the HTTP request body. Refer to the 'workaround' section for an example.
References
Related vulnerabilities
Recent vulnerabilities recorded for urllib3.
