Summary
[1.26.5-8.2]
- CVE-2026-97687 python-urllib3: urllib3: Traffic interception
via HTTPS proxy TLS configuration override
Resolves: RHEL-282326
[1.26.5-8.1]
- CVE-2026-97689 python-urllib3: urllib3: Denial of Service via unbounded
memory allocation in chunk parser
Resolves: RHEL-282267
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | python3-urllib3 | 0:1.26.5-8.el9_8.2 |
Vulnerabilities 2
-
High 8.9
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a l…
-
High 7.6
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain…