{"action":"Upgrade urllib3 to 1.26.19 or later.","affected":[{"fixed":"1.26.19","introduced":"0"},{"fixed":"2.2.2","introduced":"2.0.0"}],"component":"urllib3","cve_ids":["CVE-2024-37891"],"ecosystem":"PyPI","epss":0.01141,"exploited":false,"fixed_versions":["1.26.19","2.2.2"],"ghsa_id":"GHSA-34jh-p97f-mpxf","id":"tcs_01M5KGWWJ8D9S68S0VH30SBXVS","modified_at":"2026-07-07T17:48:15.400192088Z","published_at":"2026-07-07T14:34:34.848392Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1995","https://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxf","https://nvd.nist.gov/vuln/detail/CVE-2024-37891","https://github.com/urllib3/urllib3/commit/40b6d1605814dd1db0a46e202d6e56f2e4c9a468","https://github.com/urllib3/urllib3/commit/accff72ecc2f6cf5a76d9570198a93ac7c90270e","https://github.com/urllib3/urllib3","https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html","https://security.netapp.com/advisory/ntap-20240822-0003","https://www.vicarius.io/vsociety/posts/proxy-authorization-header-handling-vulnerability-in-urllib3-cve-2024-37891","https://pypi.org/project/urllib3","https://github.com/advisories/GHSA-34jh-p97f-mpxf"],"severity":{"label":"medium","score":4.4},"sources":[{"source":"osv","source_id":"PYSEC-2026-1995","url":"https://osv.dev/vulnerability/PYSEC-2026-1995"}],"summary":"urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects"}