{"action":"Upgrade urllib3 to 1.26.19 or later.","affected":[{"fixed":"1.26.19","introduced":"0"},{"fixed":"2.2.2","introduced":"2.0.0"}],"component":"urllib3","cve_ids":["CVE-2024-37891"],"ecosystem":"PyPI","epss":0.01141,"exploited":false,"fixed_versions":["1.26.19","2.2.2"],"ghsa_id":"GHSA-34jh-p97f-mpxf","id":"tcs_01M5KETW0M3BCXV28QPWWN4PCK","modified_at":"2026-09-10T03:50:14.811193644Z","published_at":"2024-06-17T21:37:20Z","references":["https://osv.dev/vulnerability/GHSA-34jh-p97f-mpxf","https://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxf","https://nvd.nist.gov/vuln/detail/CVE-2024-37891","https://github.com/urllib3/urllib3/commit/40b6d1605814dd1db0a46e202d6e56f2e4c9a468","https://github.com/urllib3/urllib3/commit/accff72ecc2f6cf5a76d9570198a93ac7c90270e","https://github.com/urllib3/urllib3","https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html","https://security.netapp.com/advisory/ntap-20240822-0003","https://www.vicarius.io/vsociety/posts/proxy-authorization-header-handling-vulnerability-in-urllib3-cve-2024-37891"],"severity":{"label":"medium","score":4.4},"sources":[{"source":"osv","source_id":"GHSA-34jh-p97f-mpxf","url":"https://osv.dev/vulnerability/GHSA-34jh-p97f-mpxf"}],"summary":"urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects"}