Description
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| urllib3 | urllib3 | >= 1.0, < 2.6.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-urllib3 | 2.6.3-1 | — |
| Debian 13 | python-urllib3 | No fix yet | — |
| Debian 12 | python-urllib3 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python-pip | No fix yet | — |
| Ubuntu 26.04 LTS | python-urllib3 | 2.5.0-1ubuntu1 | — |
| Ubuntu 25.10 | python-pip | No fix yet | — |
| Ubuntu 25.10 | python-urllib3 | 2.3.0-3ubuntu0.1 | USN-7927-3, USN-7927-2, USN-7927-1 |
| Ubuntu 24.04 LTS | python-urllib3 | 2.0.7-1ubuntu0.3 | USN-7927-3, USN-7927-2, USN-7927-1 |
| Ubuntu 22.04 LTS | python-urllib3 | 1.26.5-1~exp1ubuntu0.4 | USN-7927-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | python-pip | 25.1.1+dfsg-1ubuntu2+esm3 | USN-8344-3 |
| Ubuntu Pro 24.04 LTS | python-pip | 24.0+dfsg-1ubuntu1.3+esm3 | USN-8344-3 |
| Ubuntu Pro 22.04 LTS | python-pip | 22.0.2+dfsg-1ubuntu0.7+esm3 | USN-8344-3 |
| Ubuntu Pro 20.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python-urllib3 | 1.25.8-2ubuntu0.4+esm2 | USN-7927-1 |
| Ubuntu Pro 18.04 LTS | python-pip +1 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | python-pip +1 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | python-pip +1 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | python-urllib3 +1 | 1.26.19-2.el10_1.1 | RHSA-2026:1086 |
| RHEL 9 | fence-virt +56 | 4.10.0-98.el9_7.4 | RHSA-2026:1239 |
| RHEL 9 | python-urllib3 +1 | 1.26.5-6.el9_7.1 | RHSA-2026:1087 |
| RHEL 9 | python3.11-urllib3 | 1.26.12-5.el9_7.1 | RHSA-2026:1089 |
| RHEL 9 | python3.12-urllib3 | 1.26.19-1.el9_7.1 | RHSA-2026:1088 |
| RHEL 8 | fence-agents +48 | 4.2.1-129.el8_10.20 | RHSA-2026:1240 |
| RHEL 8 | python-urllib3 +1 | 1.24.2-9.el8_10 | RHSA-2026:1254 |
| RHEL 8 | python3.11-urllib3 | 1.26.12-6.el8_10 | RHSA-2026:1224 |
| RHEL 8 | python3.12-urllib3 | 1.26.19-2.el8_10 | RHSA-2026:1226 |
| RHEL 8 | resource-agents +3 | 4.9.0-54.el8_10.27 | RHSA-2026:1241 |
| RHEL 7 | python-s3transfer | 0.1.13-1.el7_9.5 | RHSA-2026:2060 |
| RHEL 7 | resource-agents +2 | 4.1.1-61.el7_9.22 | RHSA-2026:1795 |
Show 24 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | python-urllib3 +1 | 2.6.3-0.1.el8pc | RHSA-2026:2765, RHSA-2026:2764 |
| Red Hat Satellite Capsule 6 | python3.12-aiohttp | 3.13.3-1.el9pc | RHSA-2026:2760 |
| Red Hat Satellite Capsule 6 | python3.12-urllib3 | 2.6.3-1.el9pc | RHSA-2026:2760 |
| Red Hat Satellite 6 | python-urllib3 +1 | 2.6.3-0.1.el8pc | RHSA-2026:2765, RHSA-2026:2764 |
| Red Hat Satellite 6 | python3.12-aiohttp | 3.13.3-1.el9pc | RHSA-2026:2760 |
| Red Hat Satellite 6 | python3.12-urllib3 | 2.6.3-1.el9pc | RHSA-2026:2760 |
| Red Hat Rhui 4 | python-urllib3 +1 | 2.6.3-1.el8ui | RHSA-2026:1485 |
| Red Hat Rhel Extras Sap Hana Els 7 | resource-agents +1 | 4.1.1-61.el7_9.22 | RHSA-2026:1795 |
| Red Hat Rhel Extras Sap Hana Els 7 | resource-agents-sap-hana-scaleout | 0.164.0-6.el7_9.22 | RHSA-2026:1795 |
| Red Hat Rhel Extras Sap Els 7 | resource-agents +1 | 4.1.1-61.el7_9.22 | RHSA-2026:1795 |
| Red Hat Rhel Extras Sap Els 7 | sap-cluster-connector | 3.0.1-37.el7_9.22 | RHSA-2026:1795 |
| RHEL 10.0 EUS | python-urllib3 +1 | 1.26.19-2.el10_0.1 | RHSA-2026:1726 |
| RHEL 9.6 EUS | fence-virt +56 | 4.10.0-86.el9_6.14 | RHSA-2026:1706 |
| RHEL 9.6 EUS | python-urllib3 +1 | 1.26.5-6.el9_6.1 | RHSA-2026:1729 |
| RHEL 9.6 EUS | python3.11-urllib3 | 1.26.12-5.el9_6.1 | RHSA-2026:1704 |
| RHEL 9.6 EUS | python3.12-urllib3 | 1.26.19-1.el9_6.1 | RHSA-2026:1619 |
| RHEL 9.4 EUS | fence-virt +56 | 4.10.0-62.el9_4.21 | RHSA-2026:1717 |
| RHEL 9.4 EUS | python-urllib3 +1 | 1.26.5-5.el9_4.3 | RHSA-2026:1674 |
| RHEL 9.4 EUS | python3.11-urllib3 | 1.26.12-2.el9_4.3 | RHSA-2026:1712 |
| RHEL 9.4 EUS | python3.12-urllib3 | 1.26.18-2.el9_4.2 | RHSA-2026:1957 |
| RHEL 9.2 E4S | fence-virt +56 | 4.10.0-43.el9_2.18 | RHSA-2026:1735 |
| RHEL 9.2 E4S | python-urllib3 +1 | 1.26.5-3.el9_2.3 | RHSA-2026:1693 |
| RHEL 9.2 E4S | python3.11-urllib3 | 1.26.12-1.el9_2.2 | RHSA-2026:1546 |
| RHEL 9.0 E4S | fence-virt +57 | 4.10.0-20.el9_0.27 | RHSA-2026:1734 |
| RHEL 9.0 E4S | python-urllib3 +1 | 1.26.5-3.el9_0.2 | RHSA-2026:1618 |
| RHEL 8.8 TUS | fence-agents +46 | 4.2.1-112.el8_8.15 | RHSA-2026:1791 |
| RHEL 8.8 TUS | python-urllib3 +1 | 1.24.2-5.el8_8.3 | RHSA-2026:2718 |
| RHEL 8.8 TUS | python3.11-urllib3 | 1.26.12-1.el8_8.3 | RHSA-2026:1676 |
| RHEL 8.8 TUS | resource-agents +3 | 4.9.0-40.el8_8.15 | RHSA-2026:1794 |
| RHEL 8.8 E4S | fence-agents +47 | 4.2.1-112.el8_8.15 | RHSA-2026:1791 |
| RHEL 8.8 E4S | python-urllib3 +1 | 1.24.2-5.el8_8.3 | RHSA-2026:2718 |
| RHEL 8.8 E4S | python3.11-urllib3 | 1.26.12-1.el8_8.3 | RHSA-2026:1676 |
| RHEL 8.8 E4S | resource-agents +3 | 4.9.0-40.el8_8.15 | RHSA-2026:1794 |
| RHEL 8.6 TUS | fence-agents +46 | 4.2.1-89.el8_6.20 | RHSA-2026:1792 |
| RHEL 8.6 TUS | python-urllib3 +1 | 1.24.2-5.el8_6.4 | RHSA-2026:2717 |
| RHEL 8.6 TUS | resource-agents +3 | 4.9.0-16.el8_6.19 | RHSA-2026:1793 |
| RHEL 8.6 E4S | fence-agents +47 | 4.2.1-89.el8_6.20 | RHSA-2026:1792 |
| RHEL 8.6 E4S | python-urllib3 +1 | 1.24.2-5.el8_6.4 | RHSA-2026:2717 |
| RHEL 8.6 E4S | resource-agents +3 | 4.9.0-16.el8_6.19 | RHSA-2026:1793 |
| RHEL 8.6 AUS | fence-agents +42 | 4.2.1-89.el8_6.20 | RHSA-2026:1792 |
| RHEL 8.6 AUS | python-urllib3 +1 | 1.24.2-5.el8_6.4 | RHSA-2026:2717 |
| RHEL 8.4 EUS Long Life | fence-agents +42 | 4.2.1-65.el8_4.25 | RHSA-2026:1803 |
| RHEL 8.4 EUS Long Life | python-urllib3 +1 | 1.24.2-5.el8_4.1 | RHSA-2026:2723 |
| RHEL 8.4 EUS Long Life | resource-agents +2 | 4.1.1-90.el8_4.22 | RHSA-2026:1805 |
| RHEL 8.4 AUS | fence-agents +45 | 4.2.1-65.el8_4.25 | RHSA-2026:1803 |
| RHEL 8.4 AUS | python-urllib3 +1 | 1.24.2-5.el8_4.1 | RHSA-2026:2723 |
| RHEL 8.4 AUS | resource-agents +2 | 4.1.1-90.el8_4.22 | RHSA-2026:1805 |
| RHEL 8.2 AUS | python-urllib3 +1 | 1.24.2-4.el8_2.1 | RHSA-2026:2728 |
| RHEL 7 ELS | python-urllib3 | 1.10.2-7.el7_9.1 | RHSA-2026:9031 |
| RHEL 6 ELS | python-urllib3 | 1.10.2-3.el6_10.1 | RHSA-2026:11722 |
| Red Hat OpenStack 17 | python-urllib3 +1 | 1.26.5-3.el8ost.3 | RHSA-2026:28043 |
| Red Hat Ansible Automation Platform Inside 2 | receptor | 1.6.3-1.el8ap | RHSA-2026:1506, RHSA-2026:1497, RHSA-2026:1249 |
| Red Hat Ansible Automation Platform Developer 2 | python3.11-django | 4.2.27-1.el8ap | RHSA-2026:1506, RHSA-2026:1249 |
| Red Hat Ansible Automation Platform Developer 2 | python3.11-urllib3 | 2.6.3-1.el8ap | RHSA-2026:1506, RHSA-2026:1249 |
| Red Hat Ansible Automation Platform Developer 2 | receptor | 1.6.3-1.el8ap | RHSA-2026:1506, RHSA-2026:1497, RHSA-2026:1249 |
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.5.30-1.el8ap | RHSA-2026:1506, RHSA-2026:1497, RHSA-2026:1249 |
| Red Hat Ansible Automation Platform 2 | python3.11-django | 4.2.27-1.el8ap | RHSA-2026:1506, RHSA-2026:1249 |
| Red Hat Ansible Automation Platform 2 | python3.11-protobuf | 4.25.8-1.el9ap | RHSA-2026:1249 |
| Red Hat Ansible Automation Platform 2 | python3.11-urllib3 | 2.6.3-1.el8ap | RHSA-2026:1506, RHSA-2026:1249 |
| Red Hat Ansible Automation Platform 2 | receptor | 1.6.3-1.el8ap | RHSA-2026:1506, RHSA-2026:1497, RHSA-2026:1249 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | python3-urllib3 | 1.26.19-2.el10_1.1 | ALSA-2026:1086 |
| AlmaLinux 9 | fence-virt +55 | 4.10.0-98.el9_7.4 | ALSA-2026:1239 |
| AlmaLinux 9 | python3-urllib3 | 1.26.5-6.el9_7.1 | ALSA-2026:1087 |
| AlmaLinux 9 | python3.11-urllib3 | 1.26.12-5.el9_7.1 | ALSA-2026:1089 |
| AlmaLinux 9 | python3.12-urllib3 | 1.26.19-1.el9_7.1 | ALSA-2026:1088 |
| AlmaLinux 8 | fence-agents-all +47 | 4.2.1-129.el8_10.20 | ALSA-2026:1240 |
| AlmaLinux 8 | python3-urllib3 | 1.24.2-9.el8_10 | ALSA-2026:1254 |
| AlmaLinux 8 | python3.11-urllib3 | 1.26.12-6.el8_10 | ALSA-2026:1224 |
| AlmaLinux 8 | python3.12-urllib3 | 1.26.19-2.el8_10 | ALSA-2026:1226 |
| AlmaLinux 8 | resource-agents +3 | 4.9.0-54.el8_10.27 | ALSA-2026:1241 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | python-urllib3 | 1.26.19-2.el10_1.1 | RLSA-2026:1086 |
| Rocky Linux 9 | fence-agents | 4.10.0-98.el9_7.4 | RLSA-2026:1239 |
| Rocky Linux 9 | python-urllib3 | 1.26.5-6.el9_7.1 | RLSA-2026:1087 |
| Rocky Linux 9 | python3.11-urllib3 | 1.26.12-5.el9_7.1 | RLSA-2026:1089 |
| Rocky Linux 9 | python3.12-urllib3 | 1.26.19-1.el9_7.1 | RLSA-2026:1088 |
| Rocky Linux 8 | fence-agents | 4.2.1-129.el8_10.20 | RLSA-2026:1240 |
| Rocky Linux 8 | python-urllib3 | 1.24.2-9.el8_10 | RLSA-2026:1254 |
| Rocky Linux 8 | python3.11-urllib3 | 1.26.12-6.el8_10 | RLSA-2026:1224 |
| Rocky Linux 8 | python3.12-urllib3 | 1.26.19-2.el8_10 | RLSA-2026:1226 |
| Rocky Linux 8 | resource-agents | 4.9.0-54.el8_10.27 | RLSA-2026:1241 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | python-urllib3 | 1.25.10-150300.4.21.1 | SUSE-SU-2026:2854-1, SUSE-SU-2026:1067-1, SUSE-SU-2026:0443-1 |
| SLES 15 SP6 | python-urllib3 | 1.25.10-150300.4.30.1 | SUSE-SU-2026:2854-2, SUSE-SU-2026:0367-2 |
| SLES 15 SP5 | python-urllib3 | 1.25.10-150300.4.30.1 | SUSE-SU-2026:2854-2, SUSE-SU-2026:0367-2 |
| SLES 15 SP4 | python-urllib3 | 1.25.10-150300.4.30.1 | SUSE-SU-2026:2854-2, SUSE-SU-2026:0367-2, SUSE-SU-2026:0367-1 |
| SLES 12 SP5 | python-urllib3 | 1.25.10-3.48.4 | SUSE-SU-2026:1412-1 |
Show 16 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | python-urllib3 | 1.25.10-3.48.4 | SUSE-SU-2026:1412-1 |
| SLES 3 | python-urllib3 | 2.0.7-150400.7.27.1 | SUSE-SU-2026:0367-1 |
| SLES 3 | python-urllib3_1 | 1.26.18-150600.3.6.1 | SUSE-SU-2026:0635-1 |
| SLES for SAP 16.0 | python-urllib3 | 2.5.0-160000.4.1 | SUSE-SU-2026:20189-1 |
| SLES for SAP 16.0 | python-urllib3_1 | 1.26.20-160000.3.1 | SUSE-SU-2026:20591-1 |
| SLES for SAP 15 SP6 | python-urllib3 | 1.25.10-150300.4.30.1 | SUSE-SU-2026:2854-2, SUSE-SU-2026:0367-2 |
| SLES for SAP 15 SP5 | python-urllib3 | 1.25.10-150300.4.30.1 | SUSE-SU-2026:2854-2, SUSE-SU-2026:0367-2 |
| SLES for SAP 15 SP4 | python-urllib3 | 1.25.10-150300.4.30.1 | SUSE-SU-2026:2854-2, SUSE-SU-2026:0367-2 |
| SLES 16.0 | python-urllib3 | 2.5.0-160000.4.1 | SUSE-SU-2026:20189-1 |
| SLES 16.0 | python-urllib3_1 | 1.26.20-160000.3.1 | SUSE-SU-2026:20591-1 |
| SLE Micro 6.2 | python-urllib3 | 2.5.0-160000.4.1 | SUSE-SU-2026:20175-1 |
| SLE Micro 6.1 | python-urllib3 | 2.1.0-slfo.1.1_4.1 | SUSE-SU-2026:20485-1 |
| SLE Micro 6.0 | python-urllib3 | 2.1.0-5.1 | SUSE-SU-2026:20443-1 |
| SLE Micro 5.5 | python-urllib3 | 1.25.10-150300.4.21.1 | SUSE-SU-2026:2854-1, SUSE-SU-2026:1067-1, SUSE-SU-2026:0443-1 |
| SLE Micro 5.4 | python-urllib3 | 1.25.10-150300.4.21.1 | SUSE-SU-2026:2854-1, SUSE-SU-2026:1067-1, SUSE-SU-2026:0443-1 |
| SLE Micro 5.3 | python-urllib3 | 1.25.10-150300.4.21.1 | SUSE-SU-2026:2854-1, SUSE-SU-2026:1067-1, SUSE-SU-2026:0443-1 |
| SLE Micro 5.2 | python-urllib3 | 1.25.10-150300.4.21.1 | SUSE-SU-2026:1067-1, SUSE-SU-2026:0443-1 |
| SLE HPC 15 SP5 | python-urllib3 | 1.25.10-150300.4.30.1 | SUSE-SU-2026:2854-2, SUSE-SU-2026:0367-2 |
| SLE HPC 15 SP4 | python-urllib3 | 1.25.10-150300.4.30.1 | SUSE-SU-2026:2854-2, SUSE-SU-2026:0367-2 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-urllib3 | 2.6.2-1.1 | openSUSE-SU-2026:10026-1 |
| openSUSE Tumbleweed | python-urllib3_1 | 1.26.20-5.1 | openSUSE-SU-2026:10096-1 |
| openSUSE Leap 16.0 | python-urllib3 | 2.5.0-160000.4.1 | openSUSE-SU-2026:20127-1 |
| openSUSE Leap 16.0 | python-urllib3_1 | 1.26.20-160000.3.1 | openSUSE-SU-2026:20271-1 |
| openSUSE Leap 15.6 | python-urllib3 | 2.0.7-150400.7.27.1 | SUSE-SU-2026:0367-1 |
| openSUSE Leap 15.6 | python-urllib3_1 | 1.26.18-150600.3.6.1 | SUSE-SU-2026:0635-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.23 | py3-urllib3 | 2.6.3-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3-pip +1 | 21.3.1-2.amzn2023.0.15 | ALAS2023-2026-1366 |
| Amazon Linux 2023 | python3-urllib3 | 1.25.10-5.amzn2023.0.6 | ALAS2023-2026-1418 |
| Amazon Linux 2023 | python3.11-pip +1 | 22.3.1-2.amzn2023.0.9 | ALAS2023-2026-1368 |
| Amazon Linux 2023 | python3.12-pip +1 | 23.2.1-4.amzn2023.0.6 | ALAS2023-2026-1367 |
| Amazon Linux 2023 | python3.13-pip +1 | 24.2-259.amzn2023.0.2 | ALAS2023-2026-1412 |
| Amazon Linux 2 | python-urllib3 | 1.25.9-1.amzn2.0.7 | ALAS2-2026-3156, ALAS2-2025-3110 |
| Amazon Linux 2 | python2-pip +2 | 20.2.2-1.amzn2.0.14 | ALAS2-2026-3126 |
| Amazon Linux 2 | python3-urllib3 | 1.25.6-2.amzn2.0.4 | ALAS2-2026-3127 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-urllib3 | 2.0.7-3 | — |
| Azure Linux 2 (CBL-Mariner) | python-urllib3 | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | python3-urllib3 | 1.26.19-2.el10_1.1 | ELSA-2026-1086 |
| Oracle Linux 9 | fence-virt +54 | 4.10.0-98.el9_7.4 | ELSA-2026-1239 |
| Oracle Linux 9 | python3-urllib3 | 1.26.5-6.el9_7.1 | ELSA-2026-1087 |
| Oracle Linux 9 | python3.11-urllib3 | 1.26.12-5.el9_7.1 | ELSA-2026-1089 |
| Oracle Linux 9 | python3.12-urllib3 | 1.26.19-1.el9_7.1 | ELSA-2026-1088 |
| Oracle Linux 8 | fence-agents-all +41 | 4.2.1-129.el8_10.20 | ELSA-2026-1240 |
| Oracle Linux 8 | python3-urllib3 | 1.24.2-9.el8_10 | ELSA-2026-1254 |
| Oracle Linux 8 | python3.11-urllib3 | 1.26.12-6.el8_10 | ELSA-2026-1224 |
| Oracle Linux 8 | python3.12-urllib3 | 1.26.19-2.el8_10 | ELSA-2026-1226 |
| Oracle Linux 8 | resource-agents | 4.9.0-54.el8_10.27 | ELSA-2026-1241 |
| Oracle Linux 7 | python-urllib3 | 1.10.2-7.0.3.el7 | ELSA-2026-9031 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow-3 +3 | 3.1.4-r0 | — |
| Wolfi rolling | az | 2.81.0-r1 | — |
| Wolfi rolling | confluent-docker-utils | 0.0.162-r4 | — |
| Wolfi rolling | dask-gateway +1 | 2025.4.0-r7 | — |
| Wolfi rolling | dask-kubernetes | 2025.7.0-r2 | — |
| Wolfi rolling | datadog-agent-7.72 +1 | 7.72.4-r22 | — |
| Wolfi rolling | datadog-agent-7.73 +1 | 7.73.3-r13 | — |
| Wolfi rolling | datadog-agent-7.77 +1 | 7.77.3-r6 | — |
| Wolfi rolling | emissary +6 | 3.10.0-r14 | — |
| Wolfi rolling | ggshield | 1.48.0-r0 | — |
| Wolfi rolling | jupyter-base-notebook | 7.5.0-r1 | — |
| Wolfi rolling | jupyter-docker-base +1 | 999.9.9_git20260925-r0 | — |
| Wolfi rolling | jwt-tool | 2.3.0-r3 | — |
| Wolfi rolling | k8s-sidecar | 2.1.4-r1 | — |
| Wolfi rolling | katib-earlystopping | 0.19.0-r3 | — |
| Wolfi rolling | katib-suggestion-hyperopt +5 | 0.19.0-r13 | — |
| Wolfi rolling | kserve +8 | 0.16.0-r6 | — |
| Wolfi rolling | kserve-storage-controller | 0.16.0-r3 | — |
| Wolfi rolling | kubeflow-jupyter-web-app | 1.10.0-r8 | — |
| Wolfi rolling | kubeflow-pipelines +8 | 2.15.0-r4 | — |
| Wolfi rolling | kubeflow-pipelines-visualization-server | 2.15.0-r1 | — |
| Wolfi rolling | kubeflow-volumes-web-app | 1.10.0-r6 | — |
| Wolfi rolling | open-webui | 0.8.12-r4 | — |
| Wolfi rolling | py3-cassandra-medusa | 0.27.0-r1 | — |
| Wolfi rolling | py3-urllib3 +5 | 2.6.1-r0 | — |
| Wolfi rolling | py3.10-pip-base +4 | 26.1.1-r0 | — |
| Wolfi rolling | py3.10-pipenv +3 | 2026.6.0-r0 | — |
| Wolfi rolling | pypy-3.10 | 7.3.19-r16 | — |
| Wolfi rolling | pypy-3.11 | 7.3.22-r0 | — |
| Wolfi rolling | semgrep +1 | 1.145.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | urllib3 | >= 1.0, < 2.6.0 | 2.6.0 | GHSA-2xpw-w6gg-jr37 |
Advisories 50
- WID-SEC-2026-2189 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- ALSA-2026:1089 Important: python3.11-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:1239 Important: fence-agents security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:1087 Important: python-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:1088 Important: python3.12-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:1086 Important: python-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:1224 Important: python3.11-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:1226 Important: python3.12-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:1240 Important: fence-agents security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:1241 Important: resource-agents security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:1254 Important: python-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-0207 Red Hat Enterprise Linux (urllib3): Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Oct 28, 2026
- RHSA-2026:9031 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:28043 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-urllib3) security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:2764 Red Hat Security Advisory: Satellite 6.17.6.3 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:2765 Red Hat Security Advisory: Satellite 6.16.6.1 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:2760 Red Hat Security Advisory: Satellite 6.18.3 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:2728 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:2718 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:2723 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:2717 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:2060 Red Hat Security Advisory: python-s3transfer security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1957 Red Hat Security Advisory: python3.12-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1805 Red Hat Security Advisory: resource-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1803 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1795 Red Hat Security Advisory: resource-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1793 Red Hat Security Advisory: resource-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1794 Red Hat Security Advisory: resource-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1791 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1792 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1735 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1734 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1729 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1726 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1717 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1712 Red Hat Security Advisory: python3.11-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1706 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1693 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1704 Red Hat Security Advisory: python3.11-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1676 Red Hat Security Advisory: python3.11-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1674 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1619 Red Hat Security Advisory: python3.12-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1618 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1546 Red Hat Security Advisory: python3.11-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1497 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1506 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1485 Red Hat Security Advisory: RHUI 4.11.3 security update - python-urllib3 Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1254 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1241 Red Hat Security Advisory: resource-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1249 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026