https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:20:30.316236+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2023:7753 ALSA-2023:7753 — Moderate: fence-agents security update 2026-10-03T11:20:34.538948+00:00

Affected: AlmaLinux:9: fence-agents-aliyun, AlmaLinux:9: fence-agents-all, AlmaLinux:9: fence-agents-amt-ws, AlmaLinux:9: fence-agents-apc, AlmaLinux:9: fence-agents-apc-snmp, AlmaLinux:9: fence-agents-aws, AlmaLinux:9: fence-agents-azure-arm, AlmaLinux:9: fence-agents-bladecenter, AlmaLinux:9: fence-agents-brocade, AlmaLinux:9: fence-agents-cisco-mds and 45 more

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

Security Fix(es):

* python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920) * python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2023-08730 bdu:2023-08730 2026-10-03T11:20:34.539166+00:00 bdu:2023-08730 https://cve.radiocsirt.org/vuln/bell-cve-2023-43804 BELL-CVE-2023-43804 2026-10-03T11:20:34.539195+00:00

Affected: Alpaquita:23: py3-urllib3, Alpaquita:stream: py3-urllib3

 https://cve.radiocsirt.org/vuln/brew-airshare-cve-2023-43804 BREW-airshare-CVE-2023-43804 — `Cookie` HTTP header isn't stripped on cross-origin redirects 2026-10-03T11:20:34.539247+00:00

Affected: Homebrew: airshare

urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.

Users **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.

## Affected usages

We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:

* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6) * Using the `Cookie` header on requests, which is mostly typical for impersonating a browser. * Not disabling HTTP redirects * Either not using HTTPS or for the origin server to redirect to a malicious origin.

## Remediation

* Upgrading to at least urllib3 v1.26.17 or v2.0.6 * Disabling HTTP redirects using `redirects=False` when sending requests. * Not using the `Cookie` header.

 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0956 certfr-2023-avi-0956 — De multiples vulnérabilités ont été découvertes dans <span class="textit">les produits Splunk</span>. Elles permettent… 2026-10-03T11:20:34.539302+00:00 certfr-2023-avi-0956 https://cve.radiocsirt.org/vuln/cleanstart-2026-bv53158 Withdrawn: CLEANSTART-2026-BV53158 — Security fixes in py3-urllib3 1.26.17-r0 2026-10-03T11:20:34.539329+00:00

Withdrawn by the publisher.

Affected: CleanStart: py3-urllib3

Package py3-urllib3 version 1.26.17-r0 fixes 1 vulnerabilities: CVE-2023-43804

 https://cve.radiocsirt.org/vuln/euvd-2026-258470 EUVD-2026-258470 2026-10-03T11:20:34.539360+00:00 EUVD-2026-258470 https://cve.radiocsirt.org/vuln/fkie_cve-2023-43804 fkie_cve-2023-43804 2026-10-03T11:20:34.539380+00:00

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.

 https://cve.radiocsirt.org/vuln/ghsa-v845-jxx5-vc9f GHSA-v845-jxx5-vc9f — `Cookie` HTTP header isn't stripped on cross-origin redirects 2026-10-03T11:20:34.539414+00:00

Affected: PyPI: urllib3

urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.

Users **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.

## Affected usages

We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:

* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6) * Using the `Cookie` header on requests, which is mostly typical for impersonating a browser. * Not disabling HTTP redirects * Either not using HTTPS or for the origin server to redirect to a malicious origin.

## Remediation

* Upgrading to at least urllib3 v1.26.17 or v2.0.6 * Disabling HTTP redirects using `redirects=False` when sending requests. * Not using the `Cookie` header.

 https://cve.radiocsirt.org/vuln/gsd-2023-43804 gsd-2023-43804 2026-10-03T11:20:34.539465+00:00 gsd-2023-43804 https://cve.radiocsirt.org/vuln/msrc_cve-2023-43804 msrc_CVE-2023-43804 — `Cookie` HTTP header isn't stripped on cross-origin redirects 2026-10-03T11:20:34.539484+00:00 msrc_CVE-2023-43804 https://cve.radiocsirt.org/vuln/oesa-2023-1707 OESA-2023-1707 — python-urllib3 security update 2026-10-03T11:20:34.539510+00:00

Affected: openEuler:20.03-LTS-SP1: python-urllib3, openEuler:20.03-LTS-SP3: python-urllib3, openEuler:22.03-LTS: python-urllib3, openEuler:22.03-LTS-SP1: python-urllib3, openEuler:22.03-LTS-SP2: python-urllib3

Sanity-friendly HTTP client for Python Security Fix(es): urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn&apos;t treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn&apos;t disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.(CVE-2023-43804)

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13301-1 openSUSE-SU-2024:13301-1 — python310-urllib3-2.0.6-1.1 on GA media 2026-10-03T11:20:34.539559+00:00

python310-urllib3-2.0.6-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2023-192 PYSEC-2023-192 2026-10-03T11:20:34.539587+00:00

Affected: PyPI: urllib3

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.

 https://cve.radiocsirt.org/vuln/rhba-2023:6852 RHBA-2023:6852 — Red Hat Bug Fix Advisory: Red Hat Quay v3.9.5 minor release 2026-10-03T11:20:34.539620+00:00

golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) python-urllib3: Cookie request header isn't stripped during cross-origin redirects

 https://cve.radiocsirt.org/vuln/suse-su-2023:4064-1 SUSE-SU-2023:4064-1 — Security update for python-urllib3 2026-10-03T11:20:34.539651+00:00

Security update for python-urllib3

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-43804 UBUNTU-CVE-2023-43804 2026-10-03T11:20:34.539675+00:00

Affected: Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:16.04:LTS: python-urllib3, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-urllib3, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:20.04:LTS: python-pip, Ubuntu:20.04:LTS: python-urllib3, Ubuntu:22.04:LTS: python-pip, Ubuntu:22.04:LTS: python-urllib3

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2862 WID-SEC-W-2023-2862 — Red Hat Enterprise Linux: Mehrere Schwachstellen 2026-10-03T11:20:34.539729+00:00

Ein entfernter Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um vertrauliche Informationen offenzulegen oder einen nicht näher spezifizierten Angriff zu starten.