{"action":"Upgrade py3-urllib3 to 1.26.4-r0 or later.","affected":[{"fixed":"1.26.4-r0","introduced":"0"}],"component":"py3-urllib3","cve_ids":[],"ecosystem":"Alpine","ecosystem_qualifier":"Alpine:v3.19","exploited":false,"fixed_versions":["1.26.4-r0"],"id":"tcs_01M5ND2YN95RV30FN4EW2PZD9B","modified_at":"2026-10-23T17:17:56.168415771Z","published_at":"2021-03-15T18:15:19.017Z","references":["https://osv.dev/vulnerability/ALPINE-CVE-2021-28363","https://security.alpinelinux.org/vuln/CVE-2021-28363"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"ALPINE-CVE-2021-28363#Alpine:v3.19/py3-urllib3","url":"https://osv.dev/vulnerability/ALPINE-CVE-2021-28363"}],"summary":"The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't g"}