Is CVE-2024-37891 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-37891 being exploited in the wild.

How severe is CVE-2024-37891?

Low severity, with a CVSS score of 3.1, published 7 July 2026.

Which products and versions are affected?

urllib3 (PyPI) ECOSYSTEM:introduced=0,fixed=1.26.19, ECOSYSTEM:introduced=0,fixed=1.26.19,introduced=2.0.0,fixed=2.2.2.

Is there a fix for CVE-2024-37891?

Yes. urllib3 (PyPI): upgrade to 1.26.19, 2.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-37891 attacked?

It is attacked over the network.

Am I affected by CVE-2024-37891?

Check whether you run urllib3 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-37891: PYSEC-2026-1995 - urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects

CVE-2024-37891 · Severity: low · CVSS 3.1 · Published 2026-07-07

urllib3 is a widely-used Python HTTP client library. Under a narrow set of circumstances, the Proxy-Authorization header containing proxy credentials is not stripped when urllib3 automatically follows HTTP redirects to different origins, potentially exposing authentication material to malicious redirect destinations. This requires misconfiguration (manually setting Proxy-Authorization without using urllib3's proxy features) and specific redirect conditions to trigger.

Technologies: urllib3 (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-37891 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-37891 being exploited in the wild.
How severe is CVE-2024-37891?: Low severity, with a CVSS score of 3.1, published 7 July 2026.
Which products and versions are affected?: urllib3 (PyPI) ECOSYSTEM:introduced=0,fixed=1.26.19, ECOSYSTEM:introduced=0,fixed=1.26.19,introduced=2.0.0,fixed=2.2.2.
Is there a fix for CVE-2024-37891?: Yes. urllib3 (PyPI): upgrade to 1.26.19, 2.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-37891 attacked?: It is attacked over the network.
Am I affected by CVE-2024-37891?: Check whether you run urllib3 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

urllib3 (PyPI): upgrade to 1.26.19, 2.2.2 or later
```
pip install "urllib3>=2.2.2"
```

Technical details

The vulnerability is an improper authentication material handling issue (CWE-669) in urllib3's redirect logic. When the Proxy-Authorization header is manually configured on a request (rather than set automatically by urllib3's ProxyManager), the library does not treat it as authentication material and therefore does not strip it during cross-origin HTTP redirects. An attacker must establish conditions where: (1) the application manually sets Proxy-Authorization without using urllib3's built-in proxy support, (2) automatic redirects are not disabled, and (3) an attacker can control a redirect target on the same protocol or trick the server into redirecting to a malicious origin. The patch adds logic to strip Proxy-Authorization headers on cross-origin redirects regardless of configuration. Affected versions: urllib3 ≤1.26.18 and ≤2.2.1; patched in 1.26.19 and 2.2.2.

Affected products

urllib3 urllib3 <=1.26.18, <=2.2.1

Identifiers

CVE-2024-37891
GHSA-34jh-p97f-mpxf
PYSEC-2026-1995

Timeline

2024-06-17: disclosed
2024-06-17: patched: urllib3 1.26.19 and 2.2.2

References

https://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.