CVE-2023-43804 - CVE House
Back to Database
Status published Medium CVE-2023-43804

`Cookie` HTTP header isn't stripped on cross-origin redirects

Vulnerability Description

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-43804

Credits & Attribution

No credits recorded in the NVD database.

References

More from urllib3

View All →
CVE-2025-66471
urllib3 Streaming API improperly handles highly compressed data
High 8.9
CVE-2025-66418
urllib3 allows an unbounded number of links in the decompression chain
High 8.9
CVE-2025-50182
urllib3 does not control redirects in browsers and Node.js
Medium 5.3
CVE-2025-50181
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
Medium 5.3
CVE-2024-37891
Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3
Medium 4.4

Affected Vendor

Affected Software

urllib3
Vulnerable Versions:
>= 2.0.0, < 2.0.6, < 1.26.17

Timeline

Official Publish: October 4th, 2023
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration