CVE-2024-37891

score

<0.1

cvss

4.4

epss

1.1%

published

2024-06-17

kev added

—

first seen

2026-10-21

urllib3 versions prior to 1.26.19 and 2.2.2 contain a low severity issue where the `Proxy-Authorization` header may be improperly sent during cross-origin redirects when not using proxy support, potentially leading to information leakage, exploit requires setting the header without proxy support, not disabling redirects, and redirecting to a malicious origin.