Skip to content
OpenAdvisories
High · 8.2 CVE-2026-44431 EUVD-2026-30046GHSA-qccp-gfcp-xxvcPYSEC-2026-141

urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

Published May 13, 2026 · Updated Jun 26, 2026 · Assigned by GitHub_M

Vendor: urllib3 Product: urllib3 Package: airflow-3 Package: aws-cli-2 Package: az Package: confluent-docker-utils Package: dask-kubernetes Package: datadog-agent-7.72 Package: datadog-agent-7.72-core-integrations Package: datadog-agent-7.73 Package: datadog-agent-7.73-core-integrations Package: datadog-agent-7.77 Package: datadog-agent-7.77-core-integrations Package: datadog-agent-7.78 Package: datadog-agent-7.78-core-integrations Package: datadog-agent-7.79 Package: datadog-agent-7.79-core-integrations Package: datadog-agent-7.80-core-integrations Package: datadog-agent-7.80-oci-compat Package: datadog-agent-7.80-s6-overlay Package: datadog-agent-7.81-core-integrations Package: ggshield Package: httpie Package: jupyter-base-notebook Package: jwt-tool Package: katib-earlystopping Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: kubeflow-pipelines-apiserver Package: kubeflow-pipelines-visualization-server Package: kubeflow-volumes-web-app Package: neuvector-manager-cli Package: open-webui Package: py3-cassandra-medusa Package: py3.10-pip-base Package: py3.10-pipenv Package: py3.11-pip-base Package: py3.11-pipenv Package: py3.12-pip-base Package: py3.12-pipenv Package: py3.13-pip-base Package: py3.13-pipenv Package: py3.14-pip-base Package: pypy-3.10 Package: pypy-3.11 Package: python-pip Package: python-urllib3 Package: python-urllib3 Package: python-urllib3 Package: semgrep Package: superset-6.0 Package: urllib3 Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu Ecosystem: Wolfi

Description

urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.

Affected products

VendorProductAffectedFixed
urllib3 urllib3 >= 1.23, < 2.7.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 python-urllib3 2.7.0-1 —
Debian 13 python-urllib3 2.3.0-3+deb13u2 —
Debian 12 python-urllib3 1.26.12-1+deb12u4 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 python-pip No fix yet —
Ubuntu 26.04 LTS python-urllib3 2.6.3-1ubuntu1.1 —
Ubuntu 25.10 python-pip No fix yet —
Ubuntu 25.10 python-urllib3 2.3.0-3ubuntu0.6 —
Ubuntu 24.04 LTS python-urllib3 2.0.7-1ubuntu0.7 —
Ubuntu 22.04 LTS python-urllib3 1.26.5-1~exp1ubuntu0.7 —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS python-pip No fix yet —
Ubuntu Pro 24.04 LTS python-pip No fix yet —
Ubuntu Pro 22.04 LTS python-pip No fix yet —
Ubuntu Pro 20.04 LTS python-pip No fix yet —
Ubuntu Pro 20.04 LTS python-urllib3 1.25.8-2ubuntu0.4+esm5 USN-8811-1
Ubuntu Pro 18.04 LTS python-pip No fix yet —
Ubuntu Pro 18.04 LTS python-urllib3 1.22-1ubuntu0.18.04.2+esm4 USN-8811-1
Ubuntu Pro 16.04 LTS python-pip No fix yet —
Ubuntu Pro 16.04 LTS python-urllib3 1.13.1-2ubuntu0.16.04.4+esm4 USN-8811-1
Ubuntu Pro 14.04 LTS python-pip +1 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 python-urllib3 +1 1.26.19-4.el10_2 RHSA-2026:28000
RHEL 10 python3.14-urllib3 2.6.3-2.el10_2 RHSA-2026:27929
RHEL 9 python-urllib3 +1 1.26.5-8.el9_8 RHSA-2026:28158
RHEL 9 python3.12-urllib3 1.26.19-3.el9_8 RHSA-2026:28159
RHEL 9 python3.14-urllib3 2.6.3-2.el9_8 RHSA-2026:28157
RHEL 8 fence-agents +48 4.2.1-129.el8_10.28 RHSA-2026:49927
RHEL 8 python-urllib3 +1 1.24.2-10.el8_10 RHSA-2026:36732
RHEL 8 python3.12-urllib3 1.26.19-3.el8_10 RHSA-2026:32992
RHEL 8 resource-agents +3 4.9.0-54.el8_10.36 RHSA-2026:47126
Show 12 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.6 EUS python-urllib3 +1 1.26.5-6.el9_6.2 RHSA-2026:59409
RHEL 9.4 E4S python-urllib3 +1 1.26.5-5.el9_4.4 RHSA-2026:60371
RHEL 9.2 E4S python-urllib3 +1 1.26.5-3.el9_2.4 RHSA-2026:60362
RHEL 8.8 TUS fence-agents +46 4.2.1-112.el8_8.20 RHSA-2026:51045
RHEL 8.8 TUS resource-agents +3 4.9.0-40.el8_8.20 RHSA-2026:47129
RHEL 8.8 E4S fence-agents +47 4.2.1-112.el8_8.20 RHSA-2026:51045
RHEL 8.8 E4S resource-agents +3 4.9.0-40.el8_8.20 RHSA-2026:47129
RHEL 8.6 EUS Long Life fence-agents +46 4.2.1-89.el8_6.25 RHSA-2026:51157
RHEL 8.6 EUS Long Life resource-agents +3 4.9.0-16.el8_6.23 RHSA-2026:47092
RHEL 8.6 AUS fence-agents +42 4.2.1-89.el8_6.25 RHSA-2026:51157
RHEL 8.4 EUS Long Life fence-agents +42 4.2.1-65.el8_4.31 RHSA-2026:51152
RHEL 8.4 EUS Long Life resource-agents +2 4.1.1-90.el8_4.26 RHSA-2026:47091
RHEL 8.4 AUS fence-agents +46 4.2.1-65.el8_4.31 RHSA-2026:51152
RHEL 8.4 AUS resource-agents +2 4.1.1-90.el8_4.26 RHSA-2026:47091
Red Hat Hardened Images 1 jaeger 2.19.0-1.hum1 RHSA-2026:25039
Red Hat Hardened Images 1 mariadb +20 3:11.8.8-3.hum1 RHSA-2026:37094
Red Hat Hardened Images 1 python-rpds-py +1 2026.6.3-1.hum1 RHSA-2026:34119
Red Hat Hardened Images 1 python-sentry-sdk +18 2.48.0-6.hum1 RHSA-2026:30169
Red Hat Hardened Images 1 python-urllib3 +5 2.7.0-3.hum1 RHSA-2026:24009
Red Hat Ansible Automation Platform Developer 2 automation-controller +1 4.7.13-2.el9ap RHSA-2026:34160
Red Hat Ansible Automation Platform Developer 2 python3.12-urllib3 2.7.0-1.el9ap RHSA-2026:34160
Red Hat Ansible Automation Platform 2 automation-controller +4 4.7.13-2.el9ap RHSA-2026:34160
Red Hat Ansible Automation Platform 2 automation-platform-ui 2.6.10-1.el9ap RHSA-2026:34160
Red Hat Ansible Automation Platform 2 python3.12-pyjwt +1 2.13.0-1.el9ap RHSA-2026:34160
Red Hat Ansible Automation Platform 2 python3.12-pysequoia 0.1.34-1.el9ap RHSA-2026:34160
Red Hat Ansible Automation Platform 2 python3.12-urllib3 2.7.0-1.el9ap RHSA-2026:34160

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 python3-urllib3 1.26.19-4.el10_2 ALSA-2026:28000
AlmaLinux 10 python3.14-urllib3 2.6.3-2.el10_2 ALSA-2026:27929
AlmaLinux 9 python3-urllib3 1.26.5-8.el9_8 ALSA-2026:28158
AlmaLinux 9 python3.12-urllib3 1.26.19-3.el9_8 ALSA-2026:28159
AlmaLinux 9 python3.14-urllib3 2.6.3-2.el9_8 ALSA-2026:28157
AlmaLinux 8 fence-agents-all +47 4.2.1-129.el8_10.28 ALSA-2026:49927
AlmaLinux 8 python3-urllib3 1.24.2-10.el8_10 ALSA-2026:36732
AlmaLinux 8 python3.12-urllib3 1.26.19-3.el8_10 ALSA-2026:32992
AlmaLinux 8 resource-agents +3 4.9.0-54.el8_10.36.alma.1 ALSA-2026:47126

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 python-urllib3 1.26.19-4.el10_2 RLSA-2026:28000
Rocky Linux 10 python3.14-urllib3 2.6.3-2.el10_2 RLSA-2026:27929
Rocky Linux 9 python-urllib3 1.26.5-8.el9_8 RLSA-2026:28158
Rocky Linux 9 python3.12-urllib3 1.26.19-3.el9_8 RLSA-2026:28159
Rocky Linux 9 python3.14-urllib3 2.6.3-2.el9_8 RLSA-2026:28157
Rocky Linux 8 fence-agents 4.2.1-129.el8_10.28 RLSA-2026:49927
Rocky Linux 8 python-urllib3 1.24.2-10.el8_10 RLSA-2026:36732
Rocky Linux 8 python3.12-urllib3 1.26.19-3.el8_10 RLSA-2026:32992
Rocky Linux 8 resource-agents 4.9.0-54.el8_10.36 RLSA-2026:47126

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 python-urllib3 2.0.7-150400.7.30.1 SUSE-SU-2026:2486-1
SLES 15 SP5 python-urllib3 2.0.7-150400.7.30.1 SUSE-SU-2026:2486-1
SLES 15 SP4 python-urllib3 2.0.7-150400.7.30.1 SUSE-SU-2026:2486-1
SLES 3 python-urllib3 2.0.7-150400.7.30.1 SUSE-SU-2026:2486-1
Show 18 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 python-urllib3 2.5.0-160000.6.1 SUSE-SU-2026:22003-1
SLES for SAP 16.0 python-urllib3_1 1.26.20-160000.4.1 SUSE-SU-2026:22011-1
SLES for SAP 15 SP6 python-urllib3 2.0.7-150400.7.30.1 SUSE-SU-2026:2486-1
SLES for SAP 15 SP5 python-urllib3 2.0.7-150400.7.30.1 SUSE-SU-2026:2486-1
SLES for SAP 15 SP4 python-urllib3 2.0.7-150400.7.30.1 SUSE-SU-2026:2486-1
SLES 16.0 python-urllib3 2.5.0-160000.6.1 SUSE-SU-2026:22003-1
SLES 16.0 python-urllib3_1 1.26.20-160000.4.1 SUSE-SU-2026:22011-1
SLE HPC 15 SP5 python-urllib3 2.0.7-150400.7.30.1 SUSE-SU-2026:2486-1
SLE HPC 15 SP4 python-urllib3 2.0.7-150400.7.30.1 SUSE-SU-2026:2486-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy +1 3.11.15-80002.4.15.4 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-cffi 1.17.1-80002.3.6.5 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-cryptography 3.3.2-80002.3.6.5 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-cssselect 1.3.0-80002.3.6.5 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-editables 0.5-80002.3.3.5 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-exceptiongroup +1 1.2.2-80002.3.3.5 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-flit-core 3.12.0-80002.3.3.4 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-hatch-fancy-pypi-readme +1 25.1.0-80002.3.3.3 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-hatch-vcs +1 0.5.0-80002.3.3.3 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-hatchling 1.31.0-80002.3.3.3 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-idna 3.10-80002.3.6.5 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-iniconfig 2.1.0-80002.3.3.3 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-iniconfig-test 2.1.0-80002.3.3.5 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-jinja2 3.1.6-80002.5.3.5 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-lxml 6.1.1-80002.3.9.5 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-packaging 24.2-80002.3.3.3 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pip 25.0.1-80002.3.3.3 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyasn1 0.6.3-80002.3.6.3 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyasn1-modules 0.4.2-80002.3.6.3 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyopenssl 23.2.0-80002.3.9.3 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyparsing 3.0.9-80002.3.6.3 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-requests 2.34.2-80002.4.6.3 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-tornado 6.3.2-80002.4.12.3 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-urllib3 2.0.7-80002.3.6.3 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-websocket-client 1.9.0-80002.3.6.3 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update scap-security-guide 0.1.80-80002.3.12.4 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update spacecmd 5.2.10-80002.3.15.3 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update uyuni-tools 5.2.17-80002.3.15.3 SUSE-SU-2026:4581-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update venv-salt-minion 3006.0-80002.5.22.3 SUSE-SU-2026:4581-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update mgr-push 5.2.5-70002.3.12.2 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy +1 3.11.15-70002.4.15.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-cffi 1.17.1-70002.3.6.2 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-cryptography 3.3.2-70002.3.6.2 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-cssselect 1.3.0-70002.3.6.2 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-editables 0.5-70002.3.3.2 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-exceptiongroup +1 1.2.2-70002.3.3.2 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-flit-core 3.12.0-70002.3.3.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-hatch-fancy-pypi-readme +1 25.1.0-70002.3.3.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-hatch-vcs +1 0.5.0-70002.3.3.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-hatchling 1.31.0-70002.3.3.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-idna 3.10-70002.3.6.2 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-iniconfig 2.1.0-70002.3.3.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-iniconfig-test 2.1.0-70002.3.3.2 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-jinja2 3.1.6-70002.5.3.2 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-lxml 6.1.1-70002.3.9.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-packaging 24.2-70002.3.3.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pip 25.0.1-70002.3.3.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyasn1 0.6.3-70002.3.6.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyasn1-modules 0.4.2-70002.3.6.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyopenssl 23.2.0-70002.3.9.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyparsing 3.0.9-70002.3.6.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-requests 2.34.2-70002.4.6.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-tornado 6.3.2-70002.4.12.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-urllib3 2.0.7-70002.3.6.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-websocket-client 1.9.0-70002.3.6.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update spacecmd 5.2.10-70002.3.15.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update spacewalk-client-tools 5.2.7-70002.3.12.1 SUSE-SU-2026:4583-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update venv-salt-minion 3006.0-70002.5.22.1 SUSE-SU-2026:4583-1
SUSE Multi Linux Manager Tools SLE-Micro-5 uyuni-tools 5.2.17-150002.3.20.1 SUSE-SU-2026:4585-1
SUSE Multi Linux Manager Tools SLE-Micro-5 venv-salt-minion 3006.0-150002.5.22.1 SUSE-SU-2026:4585-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-prometheus-prometheus 3.13.2-150002.3.19.1 SUSE-SU-2026:4585-1
SUSE Multi Linux Manager Tools SLE-15 grafana 12.4.10-150002.4.27.1 SUSE-SU-2026:4585-1
SUSE Multi Linux Manager Tools SLE-15 mgr-push 5.2.5-150002.3.12.1 SUSE-SU-2026:4585-1
SUSE Multi Linux Manager Tools SLE-15 spacecmd 5.2.10-150002.3.15.1 SUSE-SU-2026:4585-1
SUSE Multi Linux Manager Tools SLE-15 spacewalk-client-tools 5.2.7-150002.3.12.1 SUSE-SU-2026:4585-1
SUSE Multi Linux Manager Tools SLE-15 uyuni-tools 5.2.17-150002.3.20.1 SUSE-SU-2026:4585-1
SUSE Multi Linux Manager Tools SLE-15 venv-salt-minion 3006.0-150002.5.22.1 SUSE-SU-2026:4585-1
SUSE Multi Linux Manager Tools SLE-12 mgr-push 5.2.5-120002.3.12.1 SUSE-SU-2026:4584-1
SUSE Multi Linux Manager Tools SLE-12 spacecmd 5.2.10-120002.3.15.1 SUSE-SU-2026:4584-1
SUSE Multi Linux Manager Tools SLE-12 spacewalk-client-tools 5.2.7-120002.3.12.1 SUSE-SU-2026:4584-1
SUSE Multi Linux Manager Tools SLE-12 uyuni-tools 5.2.17-120002.3.18.1 SUSE-SU-2026:4584-1
SUSE Multi Linux Manager Tools SLE-12 venv-salt-minion 3006.0-120002.5.22.2 SUSE-SU-2026:4584-1
SUSE Multi Linux Manager Tools RES-7 mgr-push 5.2.5-70002.3.12.2 SUSE-SU-2026:4583-1
SUSE Multi Linux Manager Tools RES-7 spacecmd 5.2.10-70002.3.15.1 SUSE-SU-2026:4583-1
SUSE Multi Linux Manager Tools RES-7 spacewalk-client-tools 5.2.7-70002.3.12.1 SUSE-SU-2026:4583-1
SUSE Multi Linux Manager Tools RES-7 venv-salt-minion 3006.0-70002.5.22.1 SUSE-SU-2026:4583-1
SUSE Multi Linux Manager Tools EL-10 scap-security-guide 0.1.80-100002.1.6.1 SUSE-SU-2026:4580-1
SUSE Multi Linux Manager Tools EL-10 spacecmd 5.2.10-100002.1.9.1 SUSE-SU-2026:4580-1
SUSE Multi Linux Manager Tools EL-10 uyuni-tools 5.2.17-100002.1.9.1 SUSE-SU-2026:4580-1
SUSE Multi Linux Manager Tools EL-10 venv-salt-minion 3006.0-100002.1.13.1 SUSE-SU-2026:4580-1
SUSE Multi Linux Manager Tools EL-9 scap-security-guide 0.1.80-90002.3.12.1 SUSE-SU-2026:4582-1
SUSE Multi Linux Manager Tools EL-9 spacecmd 5.2.10-90002.3.15.1 SUSE-SU-2026:4582-1
SUSE Multi Linux Manager Tools EL-9 uyuni-tools 5.2.17-90002.3.15.1 SUSE-SU-2026:4582-1
SUSE Multi Linux Manager Tools EL-9 venv-salt-minion 3006.0-90002.5.22.1 SUSE-SU-2026:4582-1
SUSE Multi Linux Manager Tools EL-8 scap-security-guide 0.1.80-80002.3.12.4 SUSE-SU-2026:4581-1
SUSE Multi Linux Manager Tools EL-8 spacecmd 5.2.10-80002.3.15.3 SUSE-SU-2026:4581-1
SUSE Multi Linux Manager Tools EL-8 uyuni-tools 5.2.17-80002.3.15.3 SUSE-SU-2026:4581-1
SUSE Multi Linux Manager Tools EL-8 venv-salt-minion 3006.0-80002.5.22.3 SUSE-SU-2026:4581-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy +1 3.11.15-100002.1.9.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-cffi 1.17.1-100002.1.6.2 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-cryptography 3.3.2-100002.1.6.2 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-cssselect 1.3.0-100002.1.6.2 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-editables 0.5-100002.1.6.2 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-exceptiongroup +1 1.2.2-100002.1.6.2 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-flit-core 3.12.0-100002.1.6.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-hatch-fancy-pypi-readme +1 25.1.0-100002.1.6.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-hatch-vcs +1 0.5.0-100002.1.6.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-hatchling 1.31.0-100002.1.6.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-idna 3.10-100002.1.6.2 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-iniconfig 2.1.0-100002.1.6.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-iniconfig-test 2.1.0-100002.1.6.2 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-jinja2 3.1.6-100002.1.6.2 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-lxml 6.1.1-100002.1.9.2 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-packaging 24.2-100002.1.6.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pip 25.0.1-100002.1.6.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyasn1 0.6.3-100002.1.6.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyasn1-modules 0.4.2-100002.1.6.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyopenssl 23.2.0-100002.1.9.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyparsing 3.0.9-100002.1.6.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-requests 2.34.2-100002.1.9.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-tornado 6.3.2-100002.1.9.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-urllib3 2.0.7-100002.1.9.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-websocket-client 1.9.0-100002.1.6.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update scap-security-guide 0.1.80-100002.1.6.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update spacecmd 5.2.10-100002.1.9.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update uyuni-tools 5.2.17-100002.1.9.1 SUSE-SU-2026:4580-1
SUSE EL-10:Update:Products:MultiLinuxManagerTools:Update venv-salt-minion 3006.0-100002.1.13.1 SUSE-SU-2026:4580-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy +1 3.11.15-90002.4.15.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-cffi 1.17.1-90002.3.6.2 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-cryptography 3.3.2-90002.3.6.2 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-cssselect 1.3.0-90002.3.6.2 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-editables 0.5-90002.3.3.2 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-exceptiongroup +1 1.2.2-90002.3.3.2 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-flit-core 3.12.0-90002.3.3.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-hatch-fancy-pypi-readme +1 25.1.0-90002.3.3.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-hatch-vcs +1 0.5.0-90002.3.3.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-hatchling 1.31.0-90002.3.3.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-idna 3.10-90002.3.6.2 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-iniconfig 2.1.0-90002.3.3.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-iniconfig-test 2.1.0-90002.3.3.2 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-jinja2 3.1.6-90002.5.3.2 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-lxml 6.1.1-90002.3.9.2 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-packaging 24.2-90002.3.3.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pip 25.0.1-90002.3.3.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyasn1 0.6.3-90002.3.6.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyasn1-modules 0.4.2-90002.3.6.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyopenssl 23.2.0-90002.3.9.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyparsing 3.0.9-90002.3.6.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-requests 2.34.2-90002.4.6.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-tornado 6.3.2-90002.4.12.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-urllib3 2.0.7-90002.3.6.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-websocket-client 1.9.0-90002.3.6.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update scap-security-guide 0.1.80-90002.3.12.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update spacecmd 5.2.10-90002.3.15.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update uyuni-tools 5.2.17-90002.3.15.1 SUSE-SU-2026:4582-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update venv-salt-minion 3006.0-90002.5.22.1 SUSE-SU-2026:4582-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-urllib3_1 1.26.20-6.1 openSUSE-SU-2026:10838-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 python3-urllib3 1.25.10-5.amzn2023.0.7 ALAS2023-2026-1843
Amazon Linux 2 python-urllib3 1.25.9-1.amzn2.0.10 ALAS2-2026-3377
Amazon Linux 2 python3-urllib3 1.25.6-2.amzn2.0.6 ALAS2-2026-3376

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-urllib3 2.0.7-5 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 python3-urllib3 1.26.19-4.el10_2 ELSA-2026-28000
Oracle Linux 10 python3.14-urllib3 2.6.3-2.el10_2 ELSA-2026-27929
Oracle Linux 9 python3-urllib3 1.26.5-8.el9_8 ELSA-2026-28158
Oracle Linux 9 python3.12-urllib3 1.26.19-3.el9_8 ELSA-2026-28159
Oracle Linux 9 python3.14-urllib3 2.6.3-2.el9_8 ELSA-2026-28157
Oracle Linux 8 fence-agents-all +41 4.2.1-129.el8_10.28 ELSA-2026-49927
Oracle Linux 8 python3-urllib3 1.24.2-10.el8_10 ELSA-2026-36732
Oracle Linux 8 python3.12-urllib3 1.26.19-3.el8_10 ELSA-2026-32992
Oracle Linux 8 resource-agents 4.9.0-54.el8_10.36 ELSA-2026-47126

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling airflow-3 3.2.1-r4 —
Wolfi rolling aws-cli-2 2.34.55-r0 —
Wolfi rolling az 2.86.0-r0 —
Wolfi rolling confluent-docker-utils 0.0.172-r0 —
Wolfi rolling dask-kubernetes 2026.3.0-r5 —
Wolfi rolling datadog-agent-7.72 +1 7.72.4-r27 —
Wolfi rolling datadog-agent-7.73 +1 7.73.3-r20 —
Wolfi rolling datadog-agent-7.77 7.77.3-r15 —
Wolfi rolling datadog-agent-7.77-core-integrations 7.77.3-r10 —
Wolfi rolling datadog-agent-7.78 7.78.4-r10 —
Wolfi rolling datadog-agent-7.78-core-integrations 7.78.4-r6 —
Wolfi rolling datadog-agent-7.79 7.79.2-r2 —
Wolfi rolling datadog-agent-7.79-core-integrations 7.79.2-r1 —
Wolfi rolling datadog-agent-7.80-core-integrations 7.80.4-r11 —
Wolfi rolling datadog-agent-7.80-oci-compat +1 7.80.4-r16 —
Wolfi rolling datadog-agent-7.81-core-integrations No fix yet —
Wolfi rolling ggshield 1.49.0-r2 —
Wolfi rolling httpie 3.2.4-r10 —
Wolfi rolling jupyter-base-notebook 7.5.6-r1 —
Wolfi rolling jwt-tool 2.3.0-r6 —
Wolfi rolling katib-earlystopping +6 0.19.0-r21 —
Wolfi rolling katib-suggestion-goptuna-compat 0.19.0-r40 —
Wolfi rolling kubeflow-pipelines-apiserver 2.16.1-r3 —
Wolfi rolling kubeflow-pipelines-visualization-server 2.16.1-r1 —
Wolfi rolling kubeflow-volumes-web-app 1.10.0-r18 —
Wolfi rolling neuvector-manager-cli 5.5.1-r2 —
Wolfi rolling open-webui 0.9.6-r1 —
Wolfi rolling py3-cassandra-medusa 0.28.0-r1 —
Wolfi rolling py3.10-pip-base +4 26.1.2-r1 —
Wolfi rolling py3.10-pipenv +3 2026.6.2-r2 —
Wolfi rolling pypy-3.10 7.3.19-r20 —
Wolfi rolling pypy-3.11 7.3.23-r4 —
Wolfi rolling semgrep 1.163.0-r0 —
Wolfi rolling superset-6.0 6.0.0-r12 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI urllib3 >= 1.23, < 2.7.0 2.7.0 GHSA-qccp-gfcp-xxvc

Advisories 50

References