{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:201f753c-2584-54ac-a979-2b2ee88810a6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "urllib3", "purl": "pkg:pypi/urllib3@1.26.20.post5+tuxcare", "type": "library", "bom-ref": "pkg:pypi/urllib3@1.26.20.post5+tuxcare", "version": "1.26.20.post5+tuxcare", "pedigree": { "ancestors": [ { "name": "urllib3", "purl": "pkg:pypi/urllib3@1.26.20", "type": "library", "version": "1.26.20" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-33503", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } ], "bom-ref": "urn:uuid:9709932b-755a-525f-9cb2-7d24d7fc73a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-33503 affects version 1.26.20.post5+tuxcare of urllib3." } }, { "id": "CVE-2023-43804", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } ], "bom-ref": "urn:uuid:af80b78c-1348-5a38-8b1b-667e09594ff1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-43804 does not affect version 1.26.20.post5+tuxcare of urllib3. not_affected \u2014 The target urllib3 1.26.20.post6+tuxcare is not affected by CVE-2023-43804. The vulnerability involved Cookie headers being leaked during cross-host HTTP redirects. The fix (adding \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was introduced in upstream release 1.26.17 via commit 01220354 by Seth Michael Larson. Since the target is based on upstream 1.26.20, the fix was already present in the...", "justification": "code_not_present" } }, { "id": "CVE-2023-45803", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } ], "bom-ref": "urn:uuid:879151cc-586d-5767-903a-5e290fa41df9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-45803 does not affect version 1.26.20.post5+tuxcare of urllib3. not_affected \u2014 The target urllib3 1.26.20 is not affected by CVE-2023-45803. The vulnerability (failure to strip request body on 303 redirects) was fixed in upstream urllib3 v1.26.18 (released 2023-10-17), and that fix is present in the target version 1.26.20. The fix commit b594c5ceaca38e1ac215f916538fb128e3526a36 was authored by upstream developer Illia Volochii and shipped in the upstream release that TuxC...", "justification": "code_not_present" } }, { "id": "CVE-2024-37891", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } ], "bom-ref": "urn:uuid:010cc5f6-f5b7-5dfc-931b-c3a4fe5a3db1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-37891 does not affect version 1.26.20.post5+tuxcare of urllib3. not_affected \u2014 CVE-2024-37891 is not affecting this target. The vulnerability involved Proxy-Authorization headers being leaked on cross-origin redirects. The fix (adding \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was applied by upstream author Quentin Pradet in version 1.26.19 (June 17, 2024). Version 1.26.20, released August 29, 2024, inherited this fix before TuxCare onboarded it. The tar...", "justification": "code_not_present" } }, { "id": "CVE-2025-50181", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } ], "bom-ref": "urn:uuid:15cd773f-75c4-5d7a-aa08-a85d17a84025", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-50181 is fixed in version 1.26.20.post5+tuxcare of urllib3." } }, { "id": "CVE-2025-50182", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } ], "bom-ref": "urn:uuid:97842469-825c-5a84-8612-ce0732a4e6c4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-50182 does not affect version 1.26.20.post5+tuxcare of urllib3. not_affected \u2014 CVE-2025-50182 concerns urllib3's redirect control behavior specifically in Pyodide runtime environments. Version 1.26.20 predates the addition of Emscripten/Pyodide support to urllib3 and contains no Pyodide-related code paths. The vulnerability requires urllib3 to be used in a Pyodide runtime context, which is not possible in this version. Therefore, this CVE does not apply to version 1.26.20.", "justification": "code_not_present" } }, { "id": "CVE-2025-66418", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } ], "bom-ref": "urn:uuid:6a024ae1-49ee-5adc-857b-d3749a636606", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66418 is fixed in version 1.26.20.post5+tuxcare of urllib3." } }, { "id": "CVE-2025-66471", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } ], "bom-ref": "urn:uuid:23ad1b60-e161-5d9c-bce0-1af5e1724021", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66471 is fixed in version 1.26.20.post5+tuxcare of urllib3." } }, { "id": "CVE-2026-21441", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } ], "bom-ref": "urn:uuid:918fef4d-3bf4-5588-bd3c-c4131cac8be8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-21441 is fixed in version 1.26.20.post5+tuxcare of urllib3." } }, { "id": "CVE-2026-44431", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } ], "bom-ref": "urn:uuid:28b672eb-a66c-5013-8bb4-2d0d5cb243ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44431 is fixed in version 1.26.20.post5+tuxcare of urllib3." } }, { "id": "CVE-2026-44432", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } ], "bom-ref": "urn:uuid:fe025f28-8fdf-537a-8482-0fc94e514083", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44432 affects version 1.26.20.post5+tuxcare of urllib3." } }, { "id": "CVE-2026-97687", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } ], "bom-ref": "urn:uuid:dad25266-afd5-51aa-b525-1e008b20f88c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-97687 is fixed in version 1.26.20.post5+tuxcare of urllib3." } }, { "id": "CVE-2026-97688", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } ], "bom-ref": "urn:uuid:e5e6d163-38c9-5299-98d4-a7c2d507b934", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-97688 affects version 1.26.20.post5+tuxcare of urllib3." } }, { "id": "CVE-2026-97689", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } ], "bom-ref": "urn:uuid:73d4ee04-bf7f-5bb1-825f-d9330c7f34c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-97689 is fixed in version 1.26.20.post5+tuxcare of urllib3." } } ], "dependencies": [ { "ref": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } ] }