diff --git a/pkgs/development/python-modules/urllib3/2.nix b/pkgs/development/python-modules/urllib3/2.nix
index a67ebd62f7e3..3fc90fe5d821 100644
--- a/pkgs/development/python-modules/urllib3/2.nix
+++ b/pkgs/development/python-modules/urllib3/2.nix
@@ -4,6 +4,7 @@
 , certifi
 , cryptography
 , dateutil
+, fetchpatch
 , fetchPypi
 , idna
 , mock
@@ -26,6 +27,14 @@ buildPythonPackage rec {
     sha256 = "19188f96923873c92ccb987120ec4acaa12f0461fa9ce5d3d0772bc965a39e08";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2021-28363.patch";
+      url = "https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0.patch";
+      sha256 = "1lqhrd11p03iv14bp89rh67ynf000swmwsfvr3jpfdycdqr3ka9q";
+    })
+  ];
+
   propagatedBuildInputs = [
     brotli
     certifi
diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index b7a3f81c723f..35cb0b255640 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -19,11 +19,11 @@
 
 buildPythonPackage rec {
   pname = "urllib3";
-  version = "1.26.3";
+  version = "1.26.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "de3eedaad74a2683334e282005cd8d7f22f4d55fa690a2a1020a416cb0a47e73";
+    sha256 = "0dw9w9bs3hmr5dp3r3h43jyzzb1g1046ag7lj8pqf58i4kvj3c77";
   };
 
   propagatedBuildInputs = [