"urllib.parse component of #Python before v3.11 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters"

https://securityaffairs.com/149447/hacking/python-url-severe-vulnerability.html