Is urllib3 healthy, maintained, and safe?
No — urllib3 carries 1 unpatched critical advisory and should not be adopted without a remediation plan.
The verdict
urllib3 earns a health score of 55/100, a medium risk rating, computed deterministically from live PyPI release history, and the OSV vulnerability database. No — urllib3 carries 1 unpatched critical advisory and should not be adopted without a remediation plan.
Its most recent release shipped on 7 May 2026 — 81 days ago — so development is clearly active. Across 100 releases the cadence has been steady, which is a good sign of an ongoing maintenance rhythm. PyPI doesn't expose a reliable maintainer count, so bus-factor isn't scored here — treat maintenance depth as unknown rather than assumed.
OSV lists 38 known advisories for urllib3, including 1 critical and 9 high. Open critical advisories are the strongest possible signal to pin to a patched version, replace, or fork before shipping. Each advisory is listed with its OSV/GHSA identifier below.
urllib3 is usable but carries real signals — pin versions, watch for new advisories, and keep a fallback in mind. This is a one-time snapshot of a single package — real projects depend on dozens or hundreds of packages, and any one of them can drift or be compromised between releases. Run your own requirements.txt through the free health check, or have OSPulse monitor your whole dependency tree continuously.
Evidence trail — deterministic, auditable
Known vulnerabilities (38)
urllib3 streaming API improperly handles highly compressed data
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
urllib3 does not control redirects in browsers and Node.js
Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection
urllib3's request body not stripped after redirect from 303 status changes request method to GET
urllib3 allows an unbounded number of links in the decompression chain
Authorization Header forwarded on redirect
Uncontrolled Resource Consumption in urllib3
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
Improper Certificate Validation in urllib3
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
Catastrophic backtracking in URL authority parser when passed URL containing many @ characters
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
Improper Neutralization of CRLF Sequences in urllib3 library for Python
Urllib3 Incorrect Certificate Validation
`Cookie` HTTP header isn't stripped on cross-origin redirects
CRLF injection in urllib3
Exposure of Sensitive Information to an Unauthorized Actor in urllib3
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the li
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credential
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succe
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: thi
The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_
An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking,
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't g
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of t
urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in t
urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had i
urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=Fal
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) ca
urllib3 streaming API improperly handles highly compressed data
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
urllib3 does not control redirects in browsers and Node.js
urllib3 allows an unbounded number of links in the decompression chain
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
Key facts
- Latest version
- v2.7.0
- Last release
- 7 May 2026 (81 days ago)
- Total releases
- 100
- First release
- 11 December 2009
- Package age
- 16.6 years
- Maintainers
- not exposed by PyPI
- Known advisories
- 38
- Confidence
- High
Frequently asked
Is urllib3 still maintained?
Yes — urllib3 released as recently as 7 May 2026 (81 days ago), so it is actively maintained.
Does urllib3 have known security vulnerabilities?
Yes — OSV lists 38 advisories for urllib3, including 1 rated critical. See the advisory list on this page for the OSV/GHSA identifiers.
Is urllib3 safe to use?
No — urllib3 carries 1 unpatched critical advisory and should not be adopted without a remediation plan. OSPulse rates it 55/100 (medium risk) based on release recency, cadence and known vulnerabilities.
Alternatives to urllib3
Other PyPI packages we've checked
urllib3 is one package. What about the other hundreds in your tree?
Paste your own requirements.txt into the free health check for an instant snapshot — or let OSPulse monitor your whole dependency tree continuously, before your CVE scanner wakes up.
Data from the PyPI registry & OSV.dev · snapshot generated 2026-07-27 · scores are deterministic and recomputed on each refresh.