Skip to content
OpenAdvisories
High ELSA-2026-28159 2 CVEs

Important: python3.12-urllib3 security update (Oracle Linux 9)

Published Jun 23, 2026 · Updated Jun 23, 2026

Ecosystem: Oracle Linux

Summary

[1.26.19-3]
- Security fix for CVE-2026-44431
- Security fix for CVE-2026-44432
Resolves: RHEL-184901, RHEL-185126

[1.26.19-2]
- Security fix for CVE-2025-66471
- Security fix for CVE-2025-66418
- Security fix for CVE-2026-21441
Resolves: RHEL-142909, RHEL-139399, RHEL-142922

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 9 python3.12-urllib3 0:1.26.19-3.el9_8

Vulnerabilities 2

  • High 8.9
    CVE-2026-44432

    urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

    urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Br…

    urllib3 urllib3 open-webui katib-suggestion-hyperopt Debian Ubuntu Wolfi PyPI
  • High 8.2
    CVE-2026-44431

    urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

    urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerabili…

    urllib3 urllib3 open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Wolfi PyPI