{ "@id": "urn:uuid:18d06b18-2286-40f2-9f33-77590093fa16", "role": "Document Creator", "author": "https://tuxcare.com", "version": 12, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T23:49:00.121659+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2021-33503 affects version 1.26.20.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" }, "action_statement": "Vulnerability CVE-2021-33503 affects version 1.26.20.post2+tuxcare of urllib3." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:05:31.880608+00:00", "status_notes": "Vulnerability CVE-2023-43804 does not affect version 1.26.20.post2+tuxcare of urllib3. not_affected \u2014 The target urllib3 1.26.20.post6+tuxcare is not affected by CVE-2023-43804. The vulnerability involved Cookie headers being leaked during cross-host HTTP redirects. The fix (adding \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was introduced in upstream release 1.26.17 via commit 01220354 by Seth Michael Larson. Since the target is based on upstream 1.26.20, the fix was already present in the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-43804" }, "impact_statement": "not_affected \u2014 The target urllib3 1.26.20.post6+tuxcare is not affected by CVE-2023-43804. The vulnerability involved Cookie headers being leaked during cross-host HTTP redirects. The fix (adding \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was introduced in upstream release 1.26.17 via commit 01220354 by Seth Michael Larson. Since the target is based on upstream 1.26.20, the fix was already present in the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:15:22.334128+00:00", "status_notes": "Vulnerability CVE-2023-45803 does not affect version 1.26.20.post2+tuxcare of urllib3. not_affected \u2014 The target urllib3 1.26.20 is not affected by CVE-2023-45803. The vulnerability (failure to strip request body on 303 redirects) was fixed in upstream urllib3 v1.26.18 (released 2023-10-17), and that fix is present in the target version 1.26.20. The fix commit b594c5ceaca38e1ac215f916538fb128e3526a36 was authored by upstream developer Illia Volochii and shipped in the upstream release that TuxC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45803" }, "impact_statement": "not_affected \u2014 The target urllib3 1.26.20 is not affected by CVE-2023-45803. The vulnerability (failure to strip request body on 303 redirects) was fixed in upstream urllib3 v1.26.18 (released 2023-10-17), and that fix is present in the target version 1.26.20. The fix commit b594c5ceaca38e1ac215f916538fb128e3526a36 was authored by upstream developer Illia Volochii and shipped in the upstream release that TuxC..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-10-29T15:56:31.162629+00:00", "status_notes": "Vulnerability CVE-2024-37891 does not affect version 1.26.20.post2+tuxcare of urllib3. not_affected \u2014 CVE-2024-37891 is not affecting this target. The vulnerability involved Proxy-Authorization headers being leaked on cross-origin redirects. The fix (adding \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was applied by upstream author Quentin Pradet in version 1.26.19 (June 17, 2024). Version 1.26.20, released August 29, 2024, inherited this fix before TuxCare onboarded it. The tar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37891" }, "impact_statement": "not_affected \u2014 CVE-2024-37891 is not affecting this target. The vulnerability involved Proxy-Authorization headers being leaked on cross-origin redirects. The fix (adding \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was applied by upstream author Quentin Pradet in version 1.26.19 (June 17, 2024). Version 1.26.20, released August 29, 2024, inherited this fix before TuxCare onboarded it. The tar..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.26.20.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:49:00.121659+00:00", "status_notes": "Vulnerability CVE-2025-50182 does not affect version 1.26.20.post2+tuxcare of urllib3. not_affected \u2014 CVE-2025-50182 concerns urllib3's redirect control behavior specifically in Pyodide runtime environments. Version 1.26.20 predates the addition of Emscripten/Pyodide support to urllib3 and contains no Pyodide-related code paths. The vulnerability requires urllib3 to be used in a Pyodide runtime context, which is not possible in this version. Therefore, this CVE does not apply to version 1.26.20.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50182" }, "impact_statement": "not_affected \u2014 CVE-2025-50182 concerns urllib3's redirect control behavior specifically in Pyodide runtime environments. Version 1.26.20 predates the addition of Emscripten/Pyodide support to urllib3 and contains no Pyodide-related code paths. The vulnerability requires urllib3 to be used in a Pyodide runtime context, which is not possible in this version. Therefore, this CVE does not apply to version 1.26.20." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.26.20.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 is fixed in version 1.26.20.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66471" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21441 affects version 1.26.20.post2+tuxcare of urllib3, and is fixed in 1.26.20.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-21441" }, "action_statement": "Vulnerability CVE-2026-21441 affects version 1.26.20.post2+tuxcare of urllib3, and is fixed in 1.26.20.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 affects version 1.26.20.post2+tuxcare of urllib3, and is fixed in 1.26.20.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-44431" }, "action_statement": "Vulnerability CVE-2026-44431 affects version 1.26.20.post2+tuxcare of urllib3, and is fixed in 1.26.20.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.26.20.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.26.20.post2+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-10-01T09:30:26.237167+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 1.26.20.post2+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 1.26.20.post2+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.26.20.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.26.20.post2+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-10-01T09:30:26.237167+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 1.26.20.post2+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 1.26.20.post2+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare." } ] }