Summary
[1.26.19-5]
- CVE-2026-97689 Denial of Service via unbounded memory allocation in chunk parser
Resolves: RHEL-282256
[1.26.19-4]
- CVE-2026-97687 Traffic interception via HTTPS proxy TLS configuration override
Resolves: RHEL-282315
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | python3.12-urllib3 | 0:1.26.19-5.el8_10 |
Vulnerabilities 2
-
High 8.9
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a l…
-
High 7.6
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain…