Jump to solution
Verify

urllib3 parse_url no longer accepts [] in the URL (Fix)

Fixed
Spec
Package
urllib3
Fixed In
1.25.2
Python
2.7
Verdict
Status
Fixed
Safe for prod
Yes
Risk
Low
Last verified
2026-02-09
Own content ratio
0.32
#1585 ai auth llm Updated: 2026-02-13
Issue #1585

The Fix

pip install urllib3==1.25.2

Based on closed urllib3/urllib3 issue #1585 · PR/commit linked

Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.

Jump to Verify Open PR/Commit
@@ -6,6 +6,9 @@ dev (master) * Change ``is_ipaddress`` to not detect IPvFuture addresses. (Pull #1583) +* Change ``parse_url`` to percent-encode invalid characters within the + path, query, and target components. (Pull #1586) +
repro.py
>> parse_url('https://example.com/somevar[]') Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/home/testrunner/testvenv/lib/python2.7/site-packages/urllib3/util/url.py", line 212, in parse_url six.raise_from(LocationParseError(url), None) File "/home/testrunner/testvenv/lib/python2.7/site-packages/urllib3/packages/six.py", line 718, in raise_from raise value urllib3.exceptions.LocationParseError: Failed to parse: https://example.com/somevar[]
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
fix.md
Option A — Upgrade to fixed release\npip install urllib3==1.25.2\nWhen NOT to use: This fix is not suitable for URLs that require strict validation without percent-encoding.\n\n

Why This Fix Works in Production

  • Trigger: >> parse_url('https://example.com/somevar[]')
  • Mechanism: The parse_url function did not percent-encode invalid characters in URLs
  • Why the fix works: Changes the `parse_url` function to percent-encode invalid characters within the path, query, and target components, addressing issue #1585. (first fixed release: 1.25.2).
Production impact:
  • If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.

Why This Breaks in Prod

  • Shows up under Python 2.7 in real deployments (not just unit tests).
  • The parse_url function did not percent-encode invalid characters in URLs
  • Surfaces as: >> parse_url('https://example.com/somevar[]')

Proof / Evidence

  • GitHub issue: #1585
  • Fix PR: https://github.com/urllib3/urllib3/pull/1586
  • First fixed release: 1.25.2
  • Reproduced locally: No (not executed)
  • Last verified: 2026-02-09
  • Confidence: 0.95
  • Did this fix it?: Yes (upstream fix exists)
  • Own content ratio: 0.32

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub
“Per RFC 3986 Appendix A the only valid characters in the path component are unreserved, pct-encoded, sub-delims, :, and @ which doesn't include [ or…”
@sethmlarson · 2019-04-25 · source
“If you're looking for an alternative to parse_url you can check out the library we're using for URL parsing (rfc3986) and then not do any…”
@sethmlarson · 2019-04-25 · source
“I think we should consider percent-encoding invalid characters in the path, query, and fragment components automatically as a part of normalization though. Thoughts @urllib3/maintainers?”
@sethmlarson · 2019-04-25 · source
“No we don't currently”
@sethmlarson · 2019-04-25 · source

Failure Signature (Search String)

  • >> parse_url('https://example.com/somevar[]')

Error Message

Stack trace
error.txt
Error Message ------------- >> parse_url('https://example.com/somevar[]') Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/home/testrunner/testvenv/lib/python2.7/site-packages/urllib3/util/url.py", line 212, in parse_url six.raise_from(LocationParseError(url), None) File "/home/testrunner/testvenv/lib/python2.7/site-packages/urllib3/packages/six.py", line 718, in raise_from raise value urllib3.exceptions.LocationParseError: Failed to parse: https://example.com/somevar[]
Stack trace
error.txt
Error Message ------------- >> parse_url('http://example.com/api/search/?grouping=datasets&q=dontcare&projection=["variables.nonexistingfield"]') Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/home/testrunner/testvenv/lib/python2.7/site-packages/urllib3/util/url.py", line 212, in parse_url six.raise_from(LocationParseError(url), None) File "/home/testrunner/testvenv/lib/python2.7/site-packages/urllib3/packages/six.py", line 718, in raise_from raise value urllib3.exceptions.LocationParseError: Failed to parse: http://example.com/api/search/?grouping=datasets&q=dontcare&projection=["variables.nonexistingfield"]
Stack trace
error.txt
Error Message ------------- >> parse_url('http://www.example.com/foo.php?bar[]=1&bar[]=2&bar[]=3') Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/home/testrunner/testvenv/lib/python2.7/site-packages/urllib3/util/url.py", line 212, in parse_url six.raise_from(LocationParseError(url), None) File "/home/testrunner/testvenv/lib/python2.7/site-packages/urllib3/packages/six.py", line 718, in raise_from raise value urllib3.exceptions.LocationParseError: Failed to parse: http://www.example.com/foo.php?bar[]=1&bar[]=2&bar[]=3

Minimal Reproduction

repro.py
>> parse_url('https://example.com/somevar[]') Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/home/testrunner/testvenv/lib/python2.7/site-packages/urllib3/util/url.py", line 212, in parse_url six.raise_from(LocationParseError(url), None) File "/home/testrunner/testvenv/lib/python2.7/site-packages/urllib3/packages/six.py", line 718, in raise_from raise value urllib3.exceptions.LocationParseError: Failed to parse: https://example.com/somevar[]

Environment

  • Python: 2.7
  • urllib3: 1.25.1

What Broke

Users experienced LocationParseError when parsing URLs with square brackets.

Why It Broke

The parse_url function did not percent-encode invalid characters in URLs

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

pip install urllib3==1.25.2

When NOT to use: This fix is not suitable for URLs that require strict validation without percent-encoding.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Fix reference: https://github.com/urllib3/urllib3/pull/1586

First fixed release: 1.25.2

Last verified: 2026-02-09. Validate in your environment.

Get updates

We publish verified fixes weekly. No spam.

Subscribe

When NOT to Use This Fix

  • This fix is not suitable for URLs that require strict validation without percent-encoding.

Verify Fix

verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

  • Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
  • Upgrade behind a canary and run integration tests against the canary before 100% rollout.

Version Compatibility Table

VersionStatus
1.25.2 Fixed

Related Issues

No related fixes found.

Cluster: urllib3:configuration-error urllib3 hub urllib3 best practices All hubs All clusters
Related clusters: Data consistency SSL handshake Other

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.

Source & Disclaimer: Analysis derived from GitHub Issue #1585. Not affiliated with the library maintainers. Verify before production use.