CVE-2023-45803: urllib3 - HTTP Redirect Request Body Removal Vulnerability
Summary
CVE-2023-45803: urllib3 is a user-friendly HTTP client library for Python. Affects urllib3 across 3 version ranges.
< 1.26.18
>= 2.0.0, < 2.0.7
< 4e98d57809dacab1cbe625fddeec1a290c478ea9
Fixed in 1.26.18 or 2.0.7, depending on the release line you run. How to fix ↓
Also tracked for
- py3-urllib3 · Alpine:v3.15
The same CVE-2023-45803 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a user-friendly HTTP client library for Python. It provides a convenient way to send HTTP requests and handle responses. The library is widely used in Python applications for various purposes, including web scraping, API integration, and network communication. However, urllib3 versions prior to 1.26.18 and 2.0.7 are vulnerable to an issue where the HTTP request body is not removed when an HTTP redirect response is received. This vulnerability can potentially lead to the exposure of sensitive information if the redirected-to service or a malicious peer is compromised.
Vulnerability Detail
The vulnerability in urllib3 arises from its failure to remove the HTTP request body when an HTTP redirect response is encountered. According to HTTP RFCs, when a request method is changed from one that can accept a request body (e.g., POST) to GET, the request body should be removed. However, urllib3 did not adhere to this behavior for redirects with status codes 301, 302, or 303. Although this behavior is not explicitly specified in the section for redirects, it can be inferred from other sections and is observed in other major HTTP client implementations like curl and web browsers. Exploiting this vulnerability requires two conditions to be met: 1) Using urllib3 and submitting sensitive information in the HTTP request body, and 2) The origin service becoming compromised and redirecting to a malicious peer or a compromised redirected-to service.
How To Fix
Latest published version: 2.8.0 as of 23 Oct 2026
pip install --upgrade "urllib3==2.8.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.26.181.26.18pip install --upgrade "urllib3==1.26.18" -
>= 2.0.0, < 2.0.72.0.7pip install --upgrade "urllib3==2.0.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to update urllib3, you can disable redirects for services that do not expect redirects by setting redirects=False. Additionally, you can handle 301, 302, and 303 redirects manually by stripping the HTTP request body before following the redirect.
Conclusion
The urllib3 HTTP Redirect Request Body Removal vulnerability can potentially expose sensitive information if the redirected-to service or a malicious peer is compromised. It is crucial to update urllib3 to versions 1.26.18 or 2.0.7 to mitigate this vulnerability. If updating is not possible, disabling redirects for services that do not expect redirects or handling redirects manually by stripping the HTTP request body are recommended workarounds. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for urllib3 →
FAQ
urllib3 is a user-friendly HTTP client library for Python that provides an easy way to send HTTP requests and handle responses.
The vulnerability can potentially expose sensitive information if the redirected-to service or a malicious peer is compromised.
You can fix this vulnerability by updating urllib3 to versions 1.26.18 or 2.0.7. Alternatively, you can disable redirects for services that do not expect redirects or handle redirects manually by stripping the HTTP request body.
No, this vulnerability requires two conditions to be met: 1) Using urllib3 and submitting sensitive information in the HTTP request body, and 2) The origin service becoming compromised and redirecting to a malicious peer or a compromised redirected-to service.
Yes, if you are unable to update urllib3, you can disable redirects for services that do not expect redirects or handle redirects manually by stripping the HTTP request body.
Related vulnerabilities
Recent vulnerabilities recorded for urllib3.
