2.6.3.post2 (Python 3.9 security release)

ActiveState security release of urllib3 for Python 3.9. Upstream 2.7.0 and later require Python >= 3.10. This release is 2.6.3 plus the upstream 2.7.0 security fixes.

Security

• CVE-2026-44432 / GHSA-mf9v-mfxr-j63j (high): decompression-bomb safeguards of the streaming API were bypassed in HTTPResponse.drain_conn() after partial decoding, and on the second read(amt=N)/stream(amt=N) with the official Brotli library. Backport of urllib3/urllib3@2bdcc44d.
• CVE-2026-44431 / GHSA-qccp-gfcp-xxvc (high): pools created via ProxyManager.connection_from_url() now strip Retry.remove_headers_on_redirect headers (Authorization, Cookie, Proxy-Authorization) on cross-origin redirects. Backport of urllib3/urllib3@5ec0de49.

Versioning

The package version is 2.6.3.post2, but urllib3.__version__ stays "2.6.3" so that requests does not emit RequestsDependencyWarning. This is not the 2.6.3.1 release (the Python 3.7 back-port), which does not contain these fixes.

requires-python >= 3.9. PR: #2