From 158c67280914613c4280ada8918bb5cbdbff4eca Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Wed, 3 Jun 2026 11:47:42 +0200 Subject: [PATCH] CVE-2026-44431: Remove sensitive headers in proxy pools too --- src/urllib3/connectionpool.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/urllib3/connectionpool.py b/src/urllib3/connectionpool.py index 402bf67..c28a83c 100644 --- a/src/urllib3/connectionpool.py +++ b/src/urllib3/connectionpool.py @@ -852,6 +852,18 @@ class HTTPConnectionPool(ConnectionPool, RequestMethods): body = None headers = HTTPHeaderDict(headers)._prepare_for_method_change() + # Strip headers marked as unsafe to forward to the redirected location. + # Check remove_headers_on_redirect to avoid a potential network call within + # self.is_same_host() which may use socket.gethostbyname() in the future. + if retries.remove_headers_on_redirect and not self.is_same_host( + redirect_location + ): + if not isinstance(headers, HTTPHeaderDict): + headers = HTTPHeaderDict(headers or {}) + for header in list(six.iterkeys(headers)): + if header.lower() in retries.remove_headers_on_redirect: + headers.pop(header, None) + try: retries = retries.increment(method, url, response=response, _pool=self) except MaxRetryError: -- 2.54.0