CVE-2026-55553

Name of the Vulnerable Software and Affected Versions urllib versions prior to 2.44.1 urllib versions prior to 4.9.1

Description When following redirects via followRedirect, the software reuses caller-supplied options across different origins. Specifically, the #requestInternal() function recursively calls itself while preserving the original options object. This causes sensitive headers and authentication values to be sent to the redirect target even if it has a different scheme, host, or port.

Credential-bearing headers that may be exposed include Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token. If a request is redirected to an attacker-controlled origin, these credentials can be captured and potentially reused against the original API or related services. This issue requires no user interaction.

Recommendations Update urllib to version 2.44.1 or later. Update urllib to version 4.9.1 or later.