Summary
[2.6.3-6]
- Fix a regression with Python 3.14.8
[2.6.3-5]
- Fix test_start_closed_socket with latest Python
[2.6.3-4]
- CVE-2026-97689 python3.14-urllib3: urllib3: Denial of Service via
unbounded memory allocation in chunk parser
[2.6.3-3]
- CVE-2026-97687 python3.14-urllib3: urllib3: Traffic interception via
HTTPS proxy TLS configuration override
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | python3.14-urllib3 | 0:2.6.3-2.el9_8.6 |
Vulnerabilities 2
-
High 8.9
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a l…
-
High 7.6
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain…