urllib3 1.26.20.post3

ActiveState security release of urllib3 1.26.20 for the Python 2.7-compatible line.

Fixed

• CVE-2026-21441 / GHSA-38jv-5279-wg99 (High): HTTPResponse.drain_conn() no longer decodes redirect bodies, so a small compressed redirect body can't be inflated into memory. Backported from urllib3 2.6.3.

• CVE-2026-97689 / GHSA-vxq7-64xx-v4gw (High): chunk-size and trailer lines in streaming chunked reads are limited to 65536 bytes, and ProtocolError is raised beyond that. Backported from urllib3 2.8.0.

• CVE-2026-97687 / GHSA-8988-9cw3-xx77 (High): when forwarding through an HTTPS proxy, the TLS connection to the proxy uses the proxy's settings:

  • proxy_ssl_context is honoured.
  • A target cert_reqs can no longer disable proxy certificate verification.
  • The target's server_hostname, assert_hostname, assert_fingerprint and client certificate are no longer applied to the proxy.

  Backported from urllib3 2.8.0.

Known open

• CVE-2025-66471 / GHSA-2xpw-w6gg-jr37 (unbounded decompression in the streaming API) is not fixed in this release. It follows in 1.26.20.post4.

Versioning

1.26.20.post3 is a PEP 440 post-release. It replaces the 1.26.20+security.N local-version label used up to 1.26.20+security.2.

Tested on Python 2.7.18. Changes: #3. Dists and SLSA provenance are attached by the publish workflow.