urllib3 1.26.20.post4

ActiveState security release of urllib3 1.26.20 for the Python 2.7-compatible line.

Fixed

• CVE-2025-66471 / GHSA-2xpw-w6gg-jr37 (High): the streaming API (read(amt), stream(), read_chunked()) no longer fully decompresses small amounts of highly compressed data in one operation. Decoding is bounded by the requested amount, and the rest is kept for later reads. Ported from urllib3 2.6.0.
  • Bounded Brotli decoding needs Brotli ≥ 1.2.0, which ships Python 2.7 wheels. Older Brotli and brotlipy still decode correctly, but without a bound, and emit a DependencyWarning.
• Hardening included with the port:
  • The Deflate decoder no longer loops forever on data after the end of a stream. This is the fix for upstream CVE-2026-97688 / GHSA-gh4c-6fx4-qh6g, which the bounded decoder would otherwise have brought in.
  • drain_conn() discards the rest of a body without decoding it, 64 KiB at a time (from CVE-2026-44432 / GHSA-mf9v-mfxr-j63j).
  • stream(0) and read_chunked(0) return instead of looping.
  • The decoder is flushed when a body ends, so bounded reads never drop its last bytes. This includes raw deflate sent with Content-Length, which still truncates on upstream 2.6.0–2.8.0.

Behaviour changes

• read(amt) on a compressed response returns at most about amt decoded bytes. Any remaining output comes back on later reads.
• To read a compressed body in pieces, use stream(). closed can be True while read(amt) still has decoded data to return.
• read(decode_content=False) after a successful decode, while decoded data is still pending, raises RuntimeError instead of losing that data. It's still allowed after a failed decode.

Versioning

The package version is 1.26.20.post4, while urllib3.__version__ is now "1.26.20" (it was "1.26.20.post3" in post3). requests reads __version__ as major.minor.patch and warns on anything longer. The User-Agent header is python-urllib3/1.26.20.

Tested on Python 2.7.18. Changes: #4. Dists and SLSA provenance are attached by the publish workflow.

urllib3 1.26.20.post3

ActiveState security release of urllib3 1.26.20 for the Python 2.7-compatible line.

Fixed

• CVE-2026-21441 / GHSA-38jv-5279-wg99 (High): HTTPResponse.drain_conn() no longer decodes redirect bodies, so a small compressed redirect body can't be inflated into memory. Backported from urllib3 2.6.3.

• CVE-2026-97689 / GHSA-vxq7-64xx-v4gw (High): chunk-size and trailer lines in streaming chunked reads are limited to 65536 bytes, and ProtocolError is raised beyond that. Backported from urllib3 2.8.0.

• CVE-2026-97687 / GHSA-8988-9cw3-xx77 (High): when forwarding through an HTTPS proxy, the TLS connection to the proxy uses the proxy's settings:

  • proxy_ssl_context is honoured.
  • A target cert_reqs can no longer disable proxy certificate verification.
  • The target's server_hostname, assert_hostname, assert_fingerprint and client certificate are no longer applied to the proxy.

  Backported from urllib3 2.8.0.

Known open

• CVE-2025-66471 / GHSA-2xpw-w6gg-jr37 (unbounded decompression in the streaming API) is not fixed in this release. It follows in 1.26.20.post4.

Versioning

1.26.20.post3 is a PEP 440 post-release. It replaces the 1.26.20+security.N local-version label used up to 1.26.20+security.2.

Tested on Python 2.7.18. Changes: #3. Dists and SLSA provenance are attached by the publish workflow.

2.6.3.post2 (Python 3.9 security release)

ActiveState security release of urllib3 for Python 3.9. Upstream 2.7.0 and later require Python >= 3.10. This release is 2.6.3 plus the upstream 2.7.0 security fixes.

Security

• CVE-2026-44432 / GHSA-mf9v-mfxr-j63j (high): decompression-bomb safeguards of the streaming API were bypassed in HTTPResponse.drain_conn() after partial decoding, and on the second read(amt=N)/stream(amt=N) with the official Brotli library. Backport of urllib3/urllib3@2bdcc44d.
• CVE-2026-44431 / GHSA-qccp-gfcp-xxvc (high): pools created via ProxyManager.connection_from_url() now strip Retry.remove_headers_on_redirect headers (Authorization, Cookie, Proxy-Authorization) on cross-origin redirects. Backport of urllib3/urllib3@5ec0de49.

Versioning

The package version is 2.6.3.post2, but urllib3.__version__ stays "2.6.3" so that requests does not emit RequestsDependencyWarning. This is not the 2.6.3.1 release (the Python 3.7 back-port), which does not contain these fixes.

requires-python >= 3.9. PR: #2

urllib3 1.26.20.2

Set version to 1.26.20+security.2 (AS security release convention)

Urllib3 with Python 3.7 Compatibility

Restore Python 3.7 Compatibility to urllib3.