{"action":"Upgrade urllib3 to 1.26.18 or later.","affected":[{"fixed":"2.0.7","introduced":"2.0.0"},{"fixed":"1.26.18","introduced":"0"}],"component":"urllib3","cve_ids":["CVE-2023-45803"],"ecosystem":"PyPI","epss":0.00593,"exploited":false,"fixed_versions":["2.0.7","1.26.18"],"ghsa_id":"GHSA-g4mx-q9vg-27p4","id":"tcs_01M5KFGS15GCVSRA1VKDFREMV0","modified_at":"2026-09-10T03:50:03.706889410Z","published_at":"2023-10-17T20:15:25Z","references":["https://osv.dev/vulnerability/GHSA-g4mx-q9vg-27p4","https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4","https://nvd.nist.gov/vuln/detail/CVE-2023-45803","https://github.com/urllib3/urllib3/commit/4e50fbc5db74e32cabd5ccc1ab81fc103adfe0b3","https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9","https://github.com/urllib3/urllib3/commit/b594c5ceaca38e1ac215f916538fb128e3526a36","https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2023-212.yaml","https://github.com/urllib3/urllib3","https://github.com/urllib3/urllib3/releases/tag/1.26.18","https://github.com/urllib3/urllib3/releases/tag/2.0.7","https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX","https://www.rfc-editor.org/rfc/rfc9110.html#name-get"],"severity":{"label":"medium","score":4.2},"sources":[{"source":"osv","source_id":"GHSA-g4mx-q9vg-27p4","url":"https://osv.dev/vulnerability/GHSA-g4mx-q9vg-27p4"}],"summary":"urllib3's request body not stripped after redirect from 303 status changes request method to GET"}