Registry / http-networking / urllib3

urllib3

JSON →
library2.7.0pypypi✓ verified 26d ago

urllib3 is a powerful, user-friendly HTTP client library for Python providing thread-safe connection pooling, client-side TLS/SSL verification, multipart file uploads, retry helpers, redirect handling, and support for gzip, deflate, brotli, and zstd content encoding. Current stable version is 2.6.3 (released 2025). The project follows an active release cadence with security patches, minor feature releases, and occasional major versions; the 2.x line requires Python >=3.9 and OpenSSL >=1.1.1.

pip install urllib3
INSTALL
IMPORT
SIG · URLLIB3
U
urllib3
http-networkingpythonv2.7.0
Install
1.9s avg
Import
222ms
Disk
21MB
Pass rate
10/ 10
Env Coverage10 / 10
glibc
3.93.13
musl
3.93.13
Install & Compatibility
Where this runs
tested against v2.7.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.103.920 runs
installs and imports cleanly · install 0.0s · import 0.228s · 22.5MB
glibc
py 3.103.920 runs
installs and imports cleanly · install 1.9s · import 0.216s · 24MB
21MB installed
● package 21MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

PoolManager
import urllib3 http = urllib3.PoolManager()
Primary interface for production use; manages connection pools across multiple hosts
urllib3.request (top-level)
import urllib3 resp = urllib3.request('GET', 'https://example.com')
Convenience shortcut backed by a module-global PoolManager; side effects are shared across all callers in the same process — prefer an explicit PoolManager instance in libraries and long-running services
VerifiedHTTPSConnection
from urllib3.connection import VerifiedHTTPSConnection
from urllib3.connectionpool import VerifiedHTTPSConnection
Importing from connectionpool was accidental in v1.x and was removed in v2.0; always import from urllib3.connection
DEFAULT_CIPHERS
# Do not import DEFAULT_CIPHERS; urllib3 2.x uses system cipher list
from urllib3.util.ssl_ import DEFAULT_CIPHERS
DEFAULT_CIPHERS was removed in v2.0; urllib3 now delegates cipher selection to the system OpenSSL configuration
HTTPResponse
from urllib3.response import HTTPResponse
Returned by PoolManager.request(); access body via resp.data (bytes) or resp.json(); use resp.stream() for chunked/streaming reads
Retry
from urllib3.util.retry import Retry
Pass a Retry instance to PoolManager(retries=...) or per-request; controls retry count, backoff, status codes, and redirect behaviour
Timeout
from urllib3.util.timeout import Timeout
Use Timeout(connect=2, read=5) for separate connect/read timeouts; passing a bare float sets both

Create an explicit PoolManager and make GET/POST requests with timeout and retry logic.

import urllib3 from urllib3.util.retry import Retry from urllib3.util.timeout import Timeout # Explicit PoolManager — preferred over the module-level urllib3.request() in # library code to avoid shared global state. http = urllib3.PoolManager( timeout=Timeout(connect=3.0, read=10.0), retries=Retry(total=3, backoff_factor=0.5, status_forcelist=[500, 502, 503, 504]), ) # Simple GET — response body is bytes; call .json() for JSON payloads resp = http.request("GET", "https://httpbin.org/get") print(resp.status) # 200 print(resp.json()) # parsed JSON dict # POST with form fields resp = http.request("POST", "https://httpbin.org/post", fields={"key": "value"}) print(resp.status) # POST with JSON body (sets Content-Type: application/json automatically) resp = http.request("POST", "https://httpbin.org/post", json={"key": "value"}) print(resp.json()["json"]) # echoed back by httpbin # Streaming a large response resp = http.request("GET", "https://httpbin.org/stream-bytes/1024", preload_content=False) for chunk in resp.stream(32): print(len(chunk), "bytes") resp.release_conn()
Debug
Known issues
breakingurllib3 v2.0 dropped Python 2.7 and 3.5–3.8 support and requires OpenSSL >=1.1.1. Environments compiled against older OpenSSL (e.g. AWS Lambda Python 3.9 runtime, Amazon Linux 2) will raise an ImportError or NotOpenSSLWarning on import.
fix
Upgrade the Python runtime (Lambda: use Python 3.10+), or pin urllib3<2 if the runtime cannot be changed.
affects: <2.0
breakingVerifiedHTTPSConnection, DEFAULT_CIPHERS, and several other symbols moved or were deleted in v2.0. Importing them from their old v1.x locations (e.g. urllib3.connectionpool.VerifiedHTTPSConnection, urllib3.util.ssl_.DEFAULT_CIPHERS) raises AttributeError/ImportError.
fix
Import VerifiedHTTPSConnection from urllib3.connection; remove all references to DEFAULT_CIPHERS (urllib3 now uses the system cipher list).
affects: <2.0
breakingThe ssl_version parameter (used to pin a specific TLS protocol version) was deprecated in 2.0 and removed as of v2.6.0. Passing it now raises a TypeError.
fix
Replace ssl_version=ssl.PROTOCOL_TLSv1_2 with ssl_minimum_version=ssl.TLSVersion.TLSv1_2 when constructing an SSLContext or calling create_urllib3_context().
affects: >=2.6.0
breakingv2.0 dropped commonName certificate hostname verification; only subjectAltName is now accepted. Self-signed or legacy certs that only set CN (and not SAN) will fail TLS verification.
fix
Reissue certificates with a proper subjectAltName extension, or set cert_reqs='CERT_NONE' only for internal/test environments (never production).
affects: >=2.0
gotchaThe module-level urllib3.request() function uses a hidden global PoolManager. In libraries or multi-threaded services, calling it shares cookies, connections, and retry state across all callers in the same process.
fix
Instantiate an explicit urllib3.PoolManager() and keep it as a long-lived object; pass it around rather than relying on the global shortcut.
affects: >=2.0
gotchaResponses with preload_content=True (the default) read the entire body into memory before returning. For large or streaming responses this can exhaust memory silently.
fix
Pass preload_content=False to request(), then iterate with resp.stream(chunk_size) and always call resp.release_conn() when done.
affects: >=1.0
gotchaCVE-2026-21441 (GHSA-38jv-5279-wg99, CVSS 8.9): decompression-bomb safeguards in the streaming API were bypassed when HTTP redirects were followed. Fixed in 2.6.3.
fix
Upgrade to urllib3>=2.6.3 immediately.
affects: >=2.6.0,<2.6.3
Errors
Common errors & fixes
Max retries exceeded with url
The request failed multiple times (due to connection errors, timeouts, or server issues) and exhausted the configured number of retries.
fix
Increase the number of retries or adjust the timeout settings for your PoolManager, and ensure the target server is accessible and responsive.
```python
import urllib3

http = urllib3.PoolManager(
    retries=urllib3.Retry(total=5, backoff_factor=0.5, status_forcelist=[500, 502, 503, 504]),
    timeout=urllib3.Timeout(connect=2.0, read=5.0)
)
try:
    r = http.request('GET', 'http://example.com/resource', retries=3)
    print(r.status)
except urllib3.exceptions.MaxRetryError as e:
    print(f"Request failed after max retries: {e}")
```
CERTIFICATE_VERIFY_FAILED
urllib3 failed to verify the SSL certificate of the remote host, often due to missing or outdated CA certificates, an untrusted self-signed certificate, or a hostname mismatch.
fix
Ensure `certifi` is installed and up-to-date (`pip install --upgrade certifi`), and your `PoolManager` is configured to use it, or provide a custom CA bundle if necessary.
```python
import urllib3
import certifi

http = urllib3.PoolManager(
    cert_reqs='CERT_REQUIRED',
    ca_certs=certifi.where() # Ensures the latest CA certificates are used
)
try:
    r = http.request('GET', 'https://secure.example.com')
    print(r.status)
except urllib3.exceptions.SSLError as e:
    print(f"SSL Certificate Error: {e}")
```
Failed to establish a new connection
urllib3 was unable to establish a new TCP connection to the specified host and port, often due to the server being down, incorrect address, or network/firewall issues.
fix
Verify that the target host and port are correct, the server is running and accessible, and there are no network or firewall restrictions blocking the connection.
```python
import urllib3
import socket

http = urllib3.PoolManager()
try:
    r = http.request('GET', 'http://invalid-host-or-port.com:9999') # Correct this URL
    print(r.status)
except (urllib3.exceptions.NewConnectionError, socket.gaierror) as e:
    print(f"Connection establishment failed: {e}")
    print("Please check the hostname, port, server status, and network connectivity.")
```
ModuleNotFoundError: No module named 'urllib3'
The `urllib3` package is not installed in the Python environment currently being used or is not accessible in the `PYTHONPATH`.
fix
Install the `urllib3` library using pip in your active Python environment.
```bash
pip install urllib3
```
Upgrade
Version history
2.7.0latest on PyPI · released May 7, 2026
Audit
Dependencies
brotlioptionalBrotli content-encoding decompression (install via urllib3[brotli])
brotlicffioptionalAlternative Brotli implementation for non-CPython runtimes
zstandardoptionalZstd content-encoding decompression on Python <=3.13 (install via urllib3[zstd])
pysocksoptionalSOCKS proxy support (install via urllib3[socks])
certifioptionalMozilla CA bundle; not required — urllib3 2.x delegates cert verification to Python/OpenSSL by default, but useful for environments with no system CAs
Agent activity
24 hits · last 30 days
node
20
OpenAI (training)
1
Resources
urllib3 — pip install urllib3 · libregistry