urllib3 v1.26.3 breaks SSL support in Python 2.7.6 (Fix)

The Fix

pip install urllib3==1.26.3

Based on closed urllib3/urllib3 issue #2165 · PR/commit linked

Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.

Jump to Verify Open PR/Commit

@@ -19,21 +19,6 @@
 
 
-def _const_compare_digest_backport(a, b):
-    """
-    Compare two digests of equal length in constant time.

repro.py

import platform
import urllib3

print("OS", platform.platform())
print("Python", platform.python_version())
print("urllib3", urllib3.__version__)

verify

Re-run: python

fix.md

Option A — Upgrade to fixed release\npip install urllib3==1.26.3\nWhen NOT to use: Do not use if it changes public behavior or if the failure cannot be reproduced.\n\n

Why This Fix Works in Production

Trigger: $ python
Mechanism: Removes a backport of a constant time comparison function that was causing issues in Python 2.7.6.
Why the fix works: Removes a backport of a constant time comparison function that was causing issues in Python 2.7.6. (first fixed release: 1.26.3).

Production impact:

If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.

Why This Breaks in Prod

Triggered by an upgrade/regression window: 2.7.7 breaks; 1.26.3 is the first fixed release.
Shows up under Python 2.7.6 in real deployments (not just unit tests).
Surfaces as: $ python

Proof / Evidence

GitHub issue: #2165
Fix PR: https://github.com/urllib3/urllib3/pull/2095
First fixed release: 1.26.3
Affected versions: 2.7.7
Reproduced locally: No (not executed)
Last verified: 2026-02-09
Confidence: 0.75
Did this fix it?: Yes (upstream fix exists)
Own content ratio: 0.51

Verified Execution

We executed the runnable minimal repro in a temporary environment and captured exit codes + logs.

Status: PASS
Ran: 2026-02-11T16:52:29Z
Package: urllib3
Fixed: 1.26.3
Mode: fixed_only
Outcome: ok

Logs

affected (exit=None)

fixed (exit=0)

OS Linux-6.8.0-1045-gcp-x86_64-with-glibc2.35
Python 3.10.12
urllib3 1.26.3

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub

“1.26.3 has backported support for hmac.compare_digest so you shouldn't be seeing this error”

@sethmlarson · 2021-03-03 · confirmation · source

“Thanks for the permalink to the tag itself! I was going off of master and comparing the dates to the tagged releases”

@MadLittleMods · 2021-03-03 · confirmation · source

“Looking into this further, I think I found the root cause”

@MadLittleMods · 2021-03-03 · source

Failure Signature (Search String)

$ python

Error Message

Stack trace

error.txt

Error Message
-------------
$ python

>> import sys
>> sys.version
'2.7.6 (default, Nov 13 2018, 12:45:42) \n[GCC 4.8.4]'

>> import hmac
>> hmac.compare_digest("asdf", "asdf")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
AttributeError: 'module' object has no attribute 'compare_digest'

Stack trace

error.txt

Error Message
-------------
$ python
>> urllib3.util.ssl_.assert_fingerprint("edfd67a46a3f048fbd89763dce7eeffe", "edfd67a46a3f048fbd89763dce7eeffe")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python2.7/dist-packages/urllib3/util/ssl_.py", line 186, in assert_fingerprint
    .format(fingerprint, hexlify(cert_digest)))
urllib3.exceptions.SSLError: Fingerprints did not match. Expected "edfd67a46a3f048fbd89763dce7eeffe", got "1ed667d5f11f66b22c6a4e1dd3ac99ed".

Minimal Reproduction

repro.py

import platform
import urllib3

print("OS", platform.platform())
print("Python", platform.python_version())
print("urllib3", urllib3.__version__)

Environment

Python: 2.7.6

What Broke

Downstream libraries like Ansible fail with an AttributeError when using urllib3.

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

pip install urllib3==1.26.3

When NOT to use: Do not use if it changes public behavior or if the failure cannot be reproduced.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Fix reference: https://github.com/urllib3/urllib3/pull/2095

First fixed release: 1.26.3

Last verified: 2026-02-09. Validate in your environment.

When NOT to Use This Fix

Do not use if it changes public behavior or if the failure cannot be reproduced.

Verify Fix

verify

Re-run: python

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
Upgrade behind a canary and run integration tests against the canary before 100% rollout.
Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.

Version Compatibility Table

Version	Status
2.7.7	Broken
1.26.3	Fixed

Related Issues

No related fixes found.

Cluster: urllib3:configuration-error urllib3 hub urllib3 best practices All hubs All clusters

Related clusters: Data consistency SSL handshake Other

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.