diff --git a/homeassistant/package_constraints.txt b/homeassistant/package_constraints.txt
index 90e0a14dadc..20b6a257213 100644
--- a/homeassistant/package_constraints.txt
+++ b/homeassistant/package_constraints.txt
@@ -36,8 +36,8 @@ zeroconf==0.36.11
 
 pycryptodome>=3.6.6
 
-# Constrain urllib3 to ensure we deal with CVE-2019-11236 & CVE-2019-11324
-urllib3>=1.24.3
+# Constrain urllib3 to ensure we deal with CVE-2020-26137 and CVE-2021-33503
+urllib3>=1.26.5
 
 # Constrain H11 to ensure we get a new enough version to support non-rfc line endings
 h11>=0.12.0
diff --git a/script/gen_requirements_all.py b/script/gen_requirements_all.py
index 3d2ace4c240..3deec512b4f 100755
--- a/script/gen_requirements_all.py
+++ b/script/gen_requirements_all.py
@@ -63,8 +63,8 @@ CONSTRAINT_PATH = os.path.join(
 CONSTRAINT_BASE = """
 pycryptodome>=3.6.6
 
-# Constrain urllib3 to ensure we deal with CVE-2019-11236 & CVE-2019-11324
-urllib3>=1.24.3
+# Constrain urllib3 to ensure we deal with CVE-2020-26137 and CVE-2021-33503
+urllib3>=1.26.5
 
 # Constrain H11 to ensure we get a new enough version to support non-rfc line endings
 h11>=0.12.0