Released urllib3 2.8.0
Published on September 15, 2026 by Illia Volochii
📦 urllib3 2.8.0 is now available!
This release fixes three security issues:
- HTTPS proxy TLS configuration may be ignored or overridden (GHSA-8988-9cw3-xx77, high severity)
- HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory (GHSA-vxq7-64xx-v4gw, high severity)
- Chunked Deflate streaming can enter an infinite loop (GHSA-gh4c-6fx4-qh6g, medium severity)
Please check the advisories for details on affected use cases. If you use HTTPS proxies with custom TLS settings, take a look at the release notes too, as your configuration may need an update.
CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CVE Numbering Authority.
In addition to these vulnerability fixes, this release includes a number of security hardening improvements, including work done during the Patch the Planet initiative.
In addition to these vulnerability fixes, this release includes a number of security hardening improvements, including work done during the Patch the Planet initiative.
This is also our first immutable release on GitHub!
You'll also find faster decoding of streamed responses, new authentication helpers, and plenty of bug fixes.
Check out the details in our release notes.
Thanks to everyone who helped make this release happen, and to our supporters for helping sustain urllib3 🙏
We're still raising funds for full HTTP/2 support. Your support helps us get there!