Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-97689: urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | python3.13-pip | 0:24.2-259.amzn2023.0.9 |
| Amazon Linux · 2023 | python3.13-pip-wheel | 0:24.2-259.amzn2023.0.9 |
Vulnerabilities 1
-
High 8.9
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a l…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-97689.html