Affected versions of the urllib3 package are vulnerable to Information Disclosure due to improper handling of sensitive headers during cross-origin redirects in the low-level proxy API. When following cross-origin redirects via ProxyManager.connection_from_url().urlopen() with assert_same_host=False, sensitive headers including Authorization, Cookie, and Proxy-Authorization are not stripped, unlike the high-level API, which removes them via Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT. An attacker controlling a redirect target can capture these sensitive headers from requests that follow cross-origin redirects through the low-level proxy API path.

Affected versions of the urllib3 package are vulnerable to Denial of Service due to bypassed decompression-bomb safeguards in the streaming API. When using HTTPResponse.read(amt=N) with the official Brotli library, the second call decompresses the entire response instead of only the requested portion, and HTTPResponse.drain_conn() called after partial decompression, likewise decodes the full response in a single operation. An attacker serving a highly compressed response can cause excessive CPU usage and massive memory allocation on the client, leading to resource exhaustion.

Affected versions of the urllib3 package are vulnerable to Information Disclosure due to improper handling of sensitive headers during cross-origin redirects in the low-level proxy API. When following cross-origin redirects via ProxyManager.connection_from_url().urlopen() with assert_same_host=False, sensitive headers including Authorization, Cookie, and Proxy-Authorization are not stripped, unlike the high-level API, which removes them via Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT. An attacker controlling a redirect target can capture these sensitive headers from requests that follow cross-origin redirects through the low-level proxy API path.

Affected versions of the urllib3 package are vulnerable to Denial of Service due to bypassed decompression-bomb safeguards in the streaming API. When using HTTPResponse.read(amt=N) with the official Brotli library, the second call decompresses the entire response instead of only the requested portion, and HTTPResponse.drain_conn() called after partial decompression, likewise decodes the full response in a single operation. An attacker serving a highly compressed response can cause excessive CPU usage and massive memory allocation on the client, leading to resource exhaustion.

Affected versions of the urllib3 package are vulnerable to Information Disclosure due to improper handling of sensitive headers during cross-origin redirects in the low-level proxy API. When following cross-origin redirects via ProxyManager.connection_from_url().urlopen() with assert_same_host=False, sensitive headers including Authorization, Cookie, and Proxy-Authorization are not stripped, unlike the high-level API, which removes them via Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT. An attacker controlling a redirect target can capture these sensitive headers from requests that follow cross-origin redirects through the low-level proxy API path.

Affected versions of the urllib3 package are vulnerable to Denial of Service due to bypassed decompression-bomb safeguards in the streaming API. When using HTTPResponse.read(amt=N) with the official Brotli library, the second call decompresses the entire response instead of only the requested portion, and HTTPResponse.drain_conn() called after partial decompression, likewise decodes the full response in a single operation. An attacker serving a highly compressed response can cause excessive CPU usage and massive memory allocation on the client, leading to resource exhaustion.

Affected versions of the urllib3 package are vulnerable to Information Disclosure due to improper handling of sensitive headers during cross-origin redirects in the low-level proxy API. When following cross-origin redirects via ProxyManager.connection_from_url().urlopen() with assert_same_host=False, sensitive headers including Authorization, Cookie, and Proxy-Authorization are not stripped, unlike the high-level API, which removes them via Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT. An attacker controlling a redirect target can capture these sensitive headers from requests that follow cross-origin redirects through the low-level proxy API path.

Affected versions of the urllib3 package are vulnerable to Denial of Service due to bypassed decompression-bomb safeguards in the streaming API. When using HTTPResponse.read(amt=N) with the official Brotli library, the second call decompresses the entire response instead of only the requested portion, and HTTPResponse.drain_conn() called after partial decompression, likewise decodes the full response in a single operation. An attacker serving a highly compressed response can cause excessive CPU usage and massive memory allocation on the client, leading to resource exhaustion.

Affected versions of the urllib3 package are vulnerable to Information Disclosure due to improper handling of sensitive headers during cross-origin redirects in the low-level proxy API. When following cross-origin redirects via ProxyManager.connection_from_url().urlopen() with assert_same_host=False, sensitive headers including Authorization, Cookie, and Proxy-Authorization are not stripped, unlike the high-level API, which removes them via Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT. An attacker controlling a redirect target can capture these sensitive headers from requests that follow cross-origin redirects through the low-level proxy API path.

Affected versions of the urllib3 package are vulnerable to Denial of Service due to bypassed decompression-bomb safeguards in the streaming API. When using HTTPResponse.read(amt=N) with the official Brotli library, the second call decompresses the entire response instead of only the requested portion, and HTTPResponse.drain_conn() called after partial decompression, likewise decodes the full response in a single operation. An attacker serving a highly compressed response can cause excessive CPU usage and massive memory allocation on the client, leading to resource exhaustion.

Affected versions of the urllib3 package are vulnerable to Information Disclosure due to improper handling of sensitive headers during cross-origin redirects in the low-level proxy API. When following cross-origin redirects via ProxyManager.connection_from_url().urlopen() with assert_same_host=False, sensitive headers including Authorization, Cookie, and Proxy-Authorization are not stripped, unlike the high-level API, which removes them via Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT. An attacker controlling a redirect target can capture these sensitive headers from requests that follow cross-origin redirects through the low-level proxy API path.

Affected versions of the urllib3 package are vulnerable to Denial of Service due to bypassed decompression-bomb safeguards in the streaming API. When using HTTPResponse.read(amt=N) with the official Brotli library, the second call decompresses the entire response instead of only the requested portion, and HTTPResponse.drain_conn() called after partial decompression, likewise decodes the full response in a single operation. An attacker serving a highly compressed response can cause excessive CPU usage and massive memory allocation on the client, leading to resource exhaustion.