CVE-2023-43804

2 advisories.

PyPI/urllib3 CVE-2023-43804: medium 5.9, EPSS 1.36%

`Cookie` HTTP header isn't stripped on cross-origin redirects

Action: Upgrade urllib3 to 1.26.17 or later.

pip install urllib3==2.0.6

pip install urllib3==1.26.17

Affected

introduced	fixed	last affected
2.0.0	2.0.6	-
0	1.26.17	-

Fixed versions

2.0.6

1.26.17

Sources

osv: GHSA-v845-jxx5-vc9f
https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f
https://nvd.nist.gov/vuln/detail/CVE-2023-43804
https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb
https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d
https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2023-192.yaml
https://github.com/urllib3/urllib3
https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I3PR7C6RJ6JUBQKIJ644DMIJSUP36VDY
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAGZXYJ7H2G3SB47M453VQVNAWKAEJJ
https://security.netapp.com/advisory/ntap-20241213-0007
https://www.vicarius.io/vsociety/posts/cve-2023-43804-urllib3-vulnerability-3

CVE-2023-43804 · published 2023-10-02T23:27:05Z · modified 2026-09-10T03:49:24.753610811Z · JSON

PyPI/urllib3 CVE-2023-43804: high 8.1, EPSS 1.36%

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of t