Released urllib3 2.6.3
Published on January 7, 2026 by Illia Volochii
📦 urllib3 2.6.3 is now available!
It fixes a high-severity security issue related to decompression when following HTTP redirects (see advisory: GHSA-38jv-5279-wg99).
Also, the new version avoids indefinite sleeps with big Retry-After values and improves compatibility with popular dependents in Emscripten environments.
Check details in our release notes https://github.com/urllib3/urllib3/releases/tag/2.6.3
Note that we're still raising funds for full HTTP/2 support!
It fixes a high-severity security issue related to decompression when following HTTP redirects (see advisory: GHSA-38jv-5279-wg99).
Also, the new version avoids indefinite sleeps with big Retry-After values and improves compatibility with popular dependents in Emscripten environments.
Check details in our release notes https://github.com/urllib3/urllib3/releases/tag/2.6.3
Note that we're still raising funds for full HTTP/2 support!