CVE-2021-28363

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.

• CWE-295

• https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0Patch, Third Party Advisory
• https://github.com/urllib3/urllib3/commits/mainPatch, Third Party Advisory
• https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2rMitigation, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/
• https://pypi.org/project/urllib3/1.26.4/Third Party Advisory
• https://security.gentoo.org/glsa/202107-36Third Party Advisory
• https://security.gentoo.org/glsa/202305-02
• https://security.netapp.com/advisory/ntap-20240621-0007/
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
• https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0Patch, Third Party Advisory
• https://github.com/urllib3/urllib3/commits/mainPatch, Third Party Advisory
• https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2rMitigation, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/
• https://pypi.org/project/urllib3/1.26.4/Third Party Advisory
• https://security.gentoo.org/glsa/202107-36Third Party Advisory
• https://security.gentoo.org/glsa/202305-02
• https://security.netapp.com/advisory/ntap-20240621-0007/
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory

Published

Mar 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28356Remote Procedure Call Runtime Remote Code Execution Vulnerab…8.8
• CVE-2021-28357Remote Procedure Call Runtime Remote Code Execution Vulnerab…8.8
• CVE-2021-28358Remote Procedure Call Runtime Remote Code Execution Vulnerab…8.8
• CVE-2021-28359The "origin" parameter passed to some of the endpoints like …6.1
• CVE-2021-28361An issue was discovered in Storage Performance Development K…7.5
• CVE-2021-28362An issue was discovered in Contiki through 3.0. When sending…7.5
• CVE-2021-28372ThroughTek's Kalay Platform 2.0 network allows an attacker t…8.3
• CVE-2021-28373The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) befor…7.5
• CVE-2021-28374The Debian courier-authlib package before 0.71.1-2 for Couri…7.5
• CVE-2021-28375An issue was discovered in the Linux kernel through 5.11.6. …7.8
• CVE-2021-28376ChronoForms 7.0.7 allows fname Directory Traversal to read a…2.7
• CVE-2021-28377ChronoForums 2.0.11 allows av Directory Traversal to read ar…5.3