CVE-2018-25091 Authorization Header forwarded on redirect
Attackers can steal credentials from the Authorization header when urllib3 follows cross-origin redirects, exposing sensitive data to unintended hosts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-25091?
CVE-2018-25091 is a medium-severity vulnerability in n/a, published on 15 Oct 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).
Weakness: CWE-601
Which versions are affected by CVE-2018-25091?
3 open source packages ship an affected version, including urllib3. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
urllib3 PyPI | All versions | 1.24.2 |
urllib3 PyPI | All versions | 1.24.2 |
urllib3 PyPI | All versions | 1.24.2 |
Products include Python Urllib3.
How do I fix CVE-2018-25091?
Upgrade urllib3 to 1.24.2 or later.
Is CVE-2018-25091 being exploited?
There is no known exploitation of CVE-2018-25091 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-97689 urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
- CVE-2026-44432 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
- CVE-2026-21441 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
- CVE-2025-66418 urllib3 allows an unbounded number of links in the decompression chain
- CVE-2025-66471 urllib3 Streaming API improperly handles highly compressed data
Sources
Also known as DEBIAN-CVE-2018-25091, GHSA-gwvm-45gx-3cf8, MINI-8fh3-2g5h-8pr2, PYSEC-2023-207, ROOT-APP-PYPI-CVE-2018-25091, UBUNTU-CVE-2018-25091.