{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0c6a6093-0e81-5028-81b9-ff5d78682e12", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "urllib3", "purl": "pkg:pypi/urllib3@1.26.20.post6+tuxcare", "type": "library", "bom-ref": "pkg:pypi/urllib3@1.26.20.post6+tuxcare", "version": "1.26.20.post6+tuxcare", "pedigree": { "ancestors": [ { "name": "urllib3", "purl": "pkg:pypi/urllib3@1.26.20", "type": "library", "version": "1.26.20" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-33503", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } ], "bom-ref": "urn:uuid:85d254b8-3c2f-5d0c-a13e-f71960a5a074", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-33503 affects version 1.26.20.post6+tuxcare of urllib3." } }, { "id": "CVE-2023-43804", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } ], "bom-ref": "urn:uuid:9f5063de-bd4e-5d8d-aed6-52af81aef08d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-43804 does not affect version 1.26.20.post6+tuxcare of urllib3. not_affected \u2014 The target urllib3 1.26.20.post6+tuxcare is not affected by CVE-2023-43804. The vulnerability involved Cookie headers being leaked during cross-host HTTP redirects. The fix (adding \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was introduced in upstream release 1.26.17 via commit 01220354 by Seth Michael Larson. Since the target is based on upstream 1.26.20, the fix was already present in the...", "justification": "code_not_present" } }, { "id": "CVE-2023-45803", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } ], "bom-ref": "urn:uuid:ca25c15b-5e18-5457-a49b-800dfcea700b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-45803 does not affect version 1.26.20.post6+tuxcare of urllib3. not_affected \u2014 The target urllib3 1.26.20 is not affected by CVE-2023-45803. The vulnerability (failure to strip request body on 303 redirects) was fixed in upstream urllib3 v1.26.18 (released 2023-10-17), and that fix is present in the target version 1.26.20. The fix commit b594c5ceaca38e1ac215f916538fb128e3526a36 was authored by upstream developer Illia Volochii and shipped in the upstream release that TuxC...", "justification": "code_not_present" } }, { "id": "CVE-2024-37891", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } ], "bom-ref": "urn:uuid:9a5af846-90af-5a4e-b9c9-8abd9bb36ccf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-37891 does not affect version 1.26.20.post6+tuxcare of urllib3. not_affected \u2014 CVE-2024-37891 is not affecting this target. The vulnerability involved Proxy-Authorization headers being leaked on cross-origin redirects. The fix (adding \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was applied by upstream author Quentin Pradet in version 1.26.19 (June 17, 2024). Version 1.26.20, released August 29, 2024, inherited this fix before TuxCare onboarded it. The tar...", "justification": "code_not_present" } }, { "id": "CVE-2025-50181", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } ], "bom-ref": "urn:uuid:dabb5107-04af-5a23-b8d4-5ac777a4e50a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-50181 is fixed in version 1.26.20.post6+tuxcare of urllib3." } }, { "id": "CVE-2025-50182", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } ], "bom-ref": "urn:uuid:ad11d804-3e8e-5bd3-afa5-f0e472af7a79", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-50182 does not affect version 1.26.20.post6+tuxcare of urllib3. not_affected \u2014 CVE-2025-50182 concerns urllib3's redirect control behavior specifically in Pyodide runtime environments. Version 1.26.20 predates the addition of Emscripten/Pyodide support to urllib3 and contains no Pyodide-related code paths. The vulnerability requires urllib3 to be used in a Pyodide runtime context, which is not possible in this version. Therefore, this CVE does not apply to version 1.26.20.", "justification": "code_not_present" } }, { "id": "CVE-2025-66418", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } ], "bom-ref": "urn:uuid:ae2999c3-5a1e-5598-b70e-fb0df631bc94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66418 is fixed in version 1.26.20.post6+tuxcare of urllib3." } }, { "id": "CVE-2025-66471", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } ], "bom-ref": "urn:uuid:9bfaa4f2-5ce6-5921-8bfe-d835d6521360", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66471 is fixed in version 1.26.20.post6+tuxcare of urllib3." } }, { "id": "CVE-2026-21441", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } ], "bom-ref": "urn:uuid:c6ffd831-dfe9-594e-b1a4-34897214da98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-21441 is fixed in version 1.26.20.post6+tuxcare of urllib3." } }, { "id": "CVE-2026-44431", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } ], "bom-ref": "urn:uuid:ad575812-319d-5448-b8aa-6238cfd31b00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44431 is fixed in version 1.26.20.post6+tuxcare of urllib3." } }, { "id": "CVE-2026-44432", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } ], "bom-ref": "urn:uuid:a8a6ddfb-ab9c-57fb-9ee3-4c89aff4f5e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44432 affects version 1.26.20.post6+tuxcare of urllib3." } }, { "id": "CVE-2026-97687", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } ], "bom-ref": "urn:uuid:1c7e6798-5de0-5e7a-a2e4-a0fe23cd4f11", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-97687 is fixed in version 1.26.20.post6+tuxcare of urllib3." } }, { "id": "CVE-2026-97688", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } ], "bom-ref": "urn:uuid:c87dd2f9-ba7d-569e-b56b-4ddc53c43bf6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-97688 affects version 1.26.20.post6+tuxcare of urllib3." } }, { "id": "CVE-2026-97689", "affects": [ { "ref": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } ], "bom-ref": "urn:uuid:7e3f0f26-755a-536d-9baf-f513703b3e8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-97689 is fixed in version 1.26.20.post6+tuxcare of urllib3." } } ], "dependencies": [ { "ref": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } ] }