# CVE-2024-37891: PYSEC-2026-1995 - urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects

Source: https://junglewise.ai/threats/cve-2024-37891-urllib3-proxy-authorization-header-leak-in-cross-origin-redirects  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2024-37891 · Severity: low · CVSS 3.1 · Published 2026-07-07

urllib3 is a widely-used Python HTTP client library. Under a narrow set of circumstances, the Proxy-Authorization header containing proxy credentials is not stripped when urllib3 automatically follows HTTP redirects to different origins, potentially exposing authentication material to malicious redirect destinations. This requires misconfiguration (manually setting Proxy-Authorization without using urllib3's proxy features) and specific redirect conditions to trigger.

Technologies: [urllib3 (PyPI)](https://junglewise.ai/threats/technologies/urllib3). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-37891 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-37891 being exploited in the wild.

**How severe is CVE-2024-37891?** Low severity, with a CVSS score of 3.1, published 7 July 2026.

**Which products and versions are affected?** urllib3 (PyPI) ECOSYSTEM:introduced=0,fixed=1.26.19, ECOSYSTEM:introduced=0,fixed=1.26.19,introduced=2.0.0,fixed=2.2.2.

**Is there a fix for CVE-2024-37891?** Yes. urllib3 (PyPI): upgrade to 1.26.19, 2.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-37891 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-37891?** Check whether you run urllib3 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- urllib3 (PyPI): upgrade to 1.26.19, 2.2.2 or later

  ```sh
  pip install "urllib3>=2.2.2"
  ```


## Technical details

The vulnerability is an improper authentication material handling issue (CWE-669) in urllib3's redirect logic. When the Proxy-Authorization header is manually configured on a request (rather than set automatically by urllib3's ProxyManager), the library does not treat it as authentication material and therefore does not strip it during cross-origin HTTP redirects. An attacker must establish conditions where: (1) the application manually sets Proxy-Authorization without using urllib3's built-in proxy support, (2) automatic redirects are not disabled, and (3) an attacker can control a redirect target on the same protocol or trick the server into redirecting to a malicious origin. The patch adds logic to strip Proxy-Authorization headers on cross-origin redirects regardless of configuration. Affected versions: urllib3 ≤1.26.18 and ≤2.2.1; patched in 1.26.19 and 2.2.2.

## Affected products

- urllib3 urllib3 <=1.26.18, <=2.2.1

## Identifiers

- CVE-2024-37891
- GHSA-34jh-p97f-mpxf
- PYSEC-2026-1995

## Timeline

- 2024-06-17: disclosed
- 2024-06-17: patched: urllib3 1.26.19 and 2.2.2

## References

- [https://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxf](https://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxf)

## Related threats

- [urllib3 HTTP client unbounded memory allocation in chunked transfer](https://junglewise.ai/threats/cve-2026-97689-urllib3-is-an-http-client-library-for-python-from-1-10-3-until-2)
- [urllib3 infinite loop in Deflate decoder](https://junglewise.ai/threats/cve-2026-97688-urllib3-is-an-http-client-library-for-python-from-2-6-2-until-2-8)
- [urllib3 HTTPS proxy TLS settings isolation](https://junglewise.ai/threats/cve-2026-97687-urllib3-is-an-http-client-library-for-python-from-1-26-0-until-2)
- [PYSEC-2026-1997 - urllib3 does not control redirects in browsers and Node.js](https://junglewise.ai/threats/cve-2025-50182-urllib3-does-not-control-redirects-in-browsers-and-node-js)
- [PYSEC-2026-1999 - urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation](https://junglewise.ai/threats/cve-2025-50181-urllib3-redirects-are-not-disabled-when-retries-are-disabled-on)