Description
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| urllib3 | urllib3 | >= 2.6.0, < 2.7.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-urllib3 | 2.7.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python-pip | No fix yet | — |
| Ubuntu 26.04 LTS | python-urllib3 | 2.6.3-1ubuntu1.1 | — |
| Ubuntu 25.10 | python-pip | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 24.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 22.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 16.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 14.04 LTS | python-pip | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | python-urllib3 +1 | 1.26.19-4.el10_2 | RHSA-2026:28000 |
| RHEL 10 | python3.14-urllib3 | 2.6.3-2.el10_2 | RHSA-2026:27929 |
| RHEL 9 | python-urllib3 +1 | 1.26.5-8.el9_8 | RHSA-2026:28158 |
| RHEL 9 | python3.12-urllib3 | 1.26.19-3.el9_8 | RHSA-2026:28159 |
| RHEL 9 | python3.14-urllib3 | 2.6.3-2.el9_8 | RHSA-2026:28157 |
| RHEL 8 | python3.12-urllib3 | 1.26.19-3.el8_10 | RHSA-2026:32992 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.6 EUS | python-urllib3 +1 | 1.26.5-6.el9_6.2 | RHSA-2026:59409 |
| RHEL 9.4 E4S | python-urllib3 +1 | 1.26.5-5.el9_4.4 | RHSA-2026:60371 |
| RHEL 9.2 E4S | python-urllib3 +1 | 1.26.5-3.el9_2.4 | RHSA-2026:60362 |
| Red Hat Hardened Images 1 | jaeger | 2.19.0-1.hum1 | RHSA-2026:25039 |
| Red Hat Hardened Images 1 | lld +43 | 21.1.8-1.1.hum1 | RHSA-2026:7634 |
| Red Hat Hardened Images 1 | lld21 +25 | 21.1.8-6.hum1 | RHSA-2026:24069 |
| Red Hat Hardened Images 1 | mariadb +20 | 11.8.8-1.hum1 | RHSA-2026:25143 |
| Red Hat Hardened Images 1 | python-cryptography +1 | 48.0.0-3.hum1 | RHSA-2026:24014 |
| Red Hat Hardened Images 1 | python-rpds-py +1 | 2026.5.1-1.hum1 | RHSA-2026:24374 |
| Red Hat Hardened Images 1 | python-sentry-sdk +18 | 2.48.0-4.1.hum1 | RHSA-2026:7625 |
| Red Hat Hardened Images 1 | python-trustme +2 | 1.2.1-2.hum1 | RHSA-2026:24000 |
| Red Hat Hardened Images 1 | python-urllib3 +5 | 2.7.0-3.hum1 | RHSA-2026:24009 |
| Red Hat Hardened Images 1 | rust +18 | 1.96.0-1.hum1 | RHSA-2026:22934 |
| Red Hat Hardened Images 1 | trivy | 0.69.3-1.2.hum1 | RHSA-2026:15862 |
| Red Hat Ansible Automation Platform Inside 2 | ansible-core | 1:2.16.19-1.el8ap | RHSA-2026:42079, RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Inside 2 | receptor +1 | 1.6.6-1.el8ap | RHSA-2026:42079, RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Developer 2 | ansible-core | 1:2.16.19-1.el8ap | RHSA-2026:42079, RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.6.30-2.el8ap | RHSA-2026:42078, RHSA-2026:34160 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-urllib3 | 2.7.0-1.el8ap | RHSA-2026:42078, RHSA-2026:34160 |
| Red Hat Ansible Automation Platform Developer 2 | receptor +1 | 1.6.6-1.el8ap | RHSA-2026:42079, RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | ansible-core +1 | 1:2.16.19-1.el8ap | RHSA-2026:42079, RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-controller +4 | 4.6.30-2.el8ap | RHSA-2026:42079, RHSA-2026:42078, RHSA-2026:34160 |
| Red Hat Ansible Automation Platform 2 | automation-eda-controller +4 | 1.1.20-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-gateway +2 | 2.5.20260715-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy +1 | 2.6.17-1.el9ap | RHSA-2026:42079 |
| Red Hat Ansible Automation Platform 2 | automation-hub +1 | 4.10.16-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.10-1.el9ap | RHSA-2026:42079, RHSA-2026:34160 |
| Red Hat Ansible Automation Platform 2 | python3.12-gitpython | 3.1.50-1.el8ap | RHSA-2026:42079, RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pulp-ansible | 1:0.25.6-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pulp-container | 2.19.12-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pulpcore | 3.49.63-2.el8ap | RHSA-2026:42079, RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyjwt +1 | 2.13.0-1.el8ap | RHSA-2026:42078, RHSA-2026:34160 |
| Red Hat Ansible Automation Platform 2 | python3.12-pysequoia | 0.1.34-1.el8ap | RHSA-2026:42078, RHSA-2026:34160 |
| Red Hat Ansible Automation Platform 2 | python3.12-urllib3 | 2.7.0-1.el8ap | RHSA-2026:42078, RHSA-2026:34160 |
| Red Hat Ansible Automation Platform 2 | receptor +1 | 1.6.6-1.el8ap | RHSA-2026:42079, RHSA-2026:42078 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | python3-urllib3 | 1.26.19-4.el10_2 | ALSA-2026:28000 |
| AlmaLinux 10 | python3.14-urllib3 | 2.6.3-2.el10_2 | ALSA-2026:27929 |
| AlmaLinux 9 | python3-urllib3 | 1.26.5-8.el9_8 | ALSA-2026:28158 |
| AlmaLinux 9 | python3.12-urllib3 | 1.26.19-3.el9_8 | ALSA-2026:28159 |
| AlmaLinux 9 | python3.14-urllib3 | 2.6.3-2.el9_8 | ALSA-2026:28157 |
| AlmaLinux 8 | python3.12-urllib3 | 1.26.19-3.el8_10 | ALSA-2026:32992 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | python-urllib3 | 1.26.19-4.el10_2 | RLSA-2026:28000 |
| Rocky Linux 10 | python3.14-urllib3 | 2.6.3-2.el10_2 | RLSA-2026:27929 |
| Rocky Linux 9 | python-urllib3 | 1.26.5-8.el9_8 | RLSA-2026:28158 |
| Rocky Linux 9 | python3.12-urllib3 | 1.26.19-3.el9_8 | RLSA-2026:28159 |
| Rocky Linux 9 | python3.14-urllib3 | 2.6.3-2.el9_8 | RLSA-2026:28157 |
| Rocky Linux 8 | python3.12-urllib3 | 1.26.19-3.el8_10 | RLSA-2026:32992 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-urllib3 | 2.7.0-1.1 | openSUSE-SU-2026:10798-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | python3-urllib3 | 1.26.19-4.el10_2 | ELSA-2026-28000 |
| Oracle Linux 10 | python3.14-urllib3 | 2.6.3-2.el10_2 | ELSA-2026-27929 |
| Oracle Linux 9 | python3-urllib3 | 1.26.5-8.el9_8 | ELSA-2026-28158 |
| Oracle Linux 9 | python3.12-urllib3 | 1.26.19-3.el9_8 | ELSA-2026-28159 |
| Oracle Linux 9 | python3.14-urllib3 | 2.6.3-2.el9_8 | ELSA-2026-28157 |
| Oracle Linux 8 | python3.12-urllib3 | 1.26.19-3.el8_10 | ELSA-2026-32992 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow-3 | 3.2.1-r4 | — |
| Wolfi rolling | aws-cli-2 | 2.34.55-r0 | — |
| Wolfi rolling | az | 2.86.0-r0 | — |
| Wolfi rolling | confluent-docker-utils | 0.0.172-r0 | — |
| Wolfi rolling | dask-kubernetes | 2026.3.0-r5 | — |
| Wolfi rolling | datadog-agent-7.72 +1 | 7.72.4-r27 | — |
| Wolfi rolling | datadog-agent-7.73 +1 | 7.73.3-r20 | — |
| Wolfi rolling | datadog-agent-7.77 | 7.77.3-r15 | — |
| Wolfi rolling | datadog-agent-7.77-core-integrations | 7.77.3-r10 | — |
| Wolfi rolling | datadog-agent-7.78 | 7.78.4-r10 | — |
| Wolfi rolling | datadog-agent-7.78-core-integrations | 7.78.4-r6 | — |
| Wolfi rolling | datadog-agent-7.79 | 7.79.2-r2 | — |
| Wolfi rolling | datadog-agent-7.79-core-integrations | 7.79.2-r1 | — |
| Wolfi rolling | datadog-agent-7.80-core-integrations | 7.80.4-r11 | — |
| Wolfi rolling | datadog-agent-7.80-oci-compat +1 | 7.80.4-r16 | — |
| Wolfi rolling | datadog-agent-7.81-core-integrations | No fix yet | — |
| Wolfi rolling | ggshield | 1.49.0-r2 | — |
| Wolfi rolling | httpie | 3.2.4-r10 | — |
| Wolfi rolling | jupyter-base-notebook | 7.5.6-r1 | — |
| Wolfi rolling | jwt-tool | 2.3.0-r6 | — |
| Wolfi rolling | katib-earlystopping +6 | 0.19.0-r21 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
| Wolfi rolling | kubeflow-pipelines-apiserver | 2.16.1-r3 | — |
| Wolfi rolling | kubeflow-pipelines-visualization-server | 2.16.1-r1 | — |
| Wolfi rolling | kubeflow-volumes-web-app | 1.10.0-r18 | — |
| Wolfi rolling | neuvector-manager-cli | 5.5.1-r2 | — |
| Wolfi rolling | open-webui | 0.9.6-r1 | — |
| Wolfi rolling | py3-cassandra-medusa | 0.28.0-r1 | — |
| Wolfi rolling | py3.10-pip-base +4 | 26.1.2-r1 | — |
| Wolfi rolling | py3.10-pipenv +3 | 2026.6.2-r2 | — |
| Wolfi rolling | pypy-3.10 | 7.3.19-r20 | — |
| Wolfi rolling | pypy-3.11 | 7.3.23-r4 | — |
| Wolfi rolling | semgrep | 1.163.0-r0 | — |
| Wolfi rolling | superset-6.0 | 6.0.0-r12 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | urllib3 | >= 2.6.0, < 2.7.0 | 2.7.0 | GHSA-mf9v-mfxr-j63j |
Advisories 45
- RHSA-2026:34160 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:15862 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-2455 Oracle Solaris Drittanbieterkomponenten: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-1923 Red Hat Ansible Automation Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- ALSA-2026:28157 Important: python3.14-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:28158 Important: python-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:28159 Important: python3.12-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:27929 Important: python3.14-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:28000 Important: python-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:32992 Important: python3.12-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:42079 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:42078 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:22934 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:25039 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:7634 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:7625 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:60371 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:60362 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:59409 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:32992 Red Hat Security Advisory: python3.12-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:28159 Red Hat Security Advisory: python3.12-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:28158 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:28157 Red Hat Security Advisory: python3.14-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:28000 Red Hat Security Advisory: python-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:27929 Red Hat Security Advisory: python3.14-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:25143 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:24374 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:24069 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:24014 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:24000 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:24009 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- ELSA-2026-28000 Important: python-urllib3 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
- ELSA-2026-27929 Important: python3.14-urllib3 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
- RLSA-2026:32992 Important: python3.12-urllib3 security update Rocky Linux Security Advisories · Jul 1, 2026
- ELSA-2026-32992 Important: python3.12-urllib3 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 29, 2026
- RLSA-2026:28000 Important: python-urllib3 security update Rocky Linux Security Advisories · Jun 24, 2026
- RLSA-2026:28159 Important: python3.12-urllib3 security update Rocky Linux Security Advisories · Jun 24, 2026
- RLSA-2026:27929 Important: python3.14-urllib3 security update Rocky Linux Security Advisories · Jun 24, 2026
- RLSA-2026:28157 Important: python3.14-urllib3 security update Rocky Linux Security Advisories · Jun 24, 2026
- RLSA-2026:28158 Important: python-urllib3 security update Rocky Linux Security Advisories · Jun 24, 2026
- ELSA-2026-28158 Important: python-urllib3 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 24, 2026
- ELSA-2026-28157 Important: python3.14-urllib3 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 23, 2026
- ELSA-2026-28159 Important: python3.12-urllib3 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 23, 2026
- openSUSE-SU-2026:10798-1 python311-urllib3-2.7.0-1.1 on GA media SUSE / openSUSE Security Updates · May 17, 2026