Description
urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| urllib3 | urllib3 | >= 1.10.3, < 2.8.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-urllib3 | 2.8.0-1 | — |
| Debian 13 | python-urllib3 | No fix yet | — |
| Debian 12 | python-urllib3 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python-pip | No fix yet | — |
| Ubuntu 26.04 LTS | python-urllib3 | 2.6.3-1ubuntu1.2 | USN-8926-1 |
| Ubuntu 24.04 LTS | python-urllib3 | 2.0.7-1ubuntu0.8 | USN-8926-1 |
| Ubuntu 22.04 LTS | python-urllib3 | 1.26.5-1~exp1ubuntu0.8 | USN-8926-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 24.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 22.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python-urllib3 | 1.25.8-2ubuntu0.4+esm6 | USN-8926-1 |
| Ubuntu Pro 18.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python-urllib3 | 1.22-1ubuntu0.18.04.2+esm5 | USN-8926-1 |
| Ubuntu Pro 16.04 LTS | python-pip +1 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | python-pip | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | python3.14-urllib3 | 2.6.3-2.el10_2.6 | RHSA-2026:84578 |
| RHEL 9 | python3.14-urllib3 | 2.6.3-2.el9_8.6 | RHSA-2026:84577 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | python-urllib3 +5 | 2.8.0-1.hum1 | RHSA-2026:69612 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | python3-urllib3 | 1.26.19-4.el10_2.2 | ALSA-2026:85930 |
| AlmaLinux 10 | python3.14-urllib3 | 2.6.3-2.el10_2.6 | ALSA-2026:84578 |
| AlmaLinux 9 | python3-urllib3 | 1.26.5-8.el9_8.2 | ALSA-2026:90494 |
| AlmaLinux 9 | python3.12-urllib3 | 1.26.19-3.el9_8.2 | ALSA-2026:85929 |
| AlmaLinux 9 | python3.14-urllib3 | 2.6.3-2.el9_8.6 | ALSA-2026:84577 |
| AlmaLinux 8 | python3-urllib3 | 1.24.2-11.el8_10 | ALSA-2026:90759 |
| AlmaLinux 8 | python3.12-urllib3 | 1.26.19-5.el8_10 | ALSA-2026:92474 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | python-urllib3 | 1.26.19-4.el10_2.2 | RLSA-2026:85930 |
| Rocky Linux 10 | python3.14-urllib3 | 2.6.3-2.el10_2.6 | RLSA-2026:84578 |
| Rocky Linux 9 | python-urllib3 | 1.26.5-8.el9_8.2 | RLSA-2026:90494 |
| Rocky Linux 9 | python3.12-urllib3 | 1.26.19-3.el9_8.2 | RLSA-2026:85929 |
| Rocky Linux 9 | python3.14-urllib3 | 2.6.3-2.el9_8.6 | RLSA-2026:84577 |
| Rocky Linux 8 | python-urllib3 | 1.24.2-11.el8_10 | RLSA-2026:90759 |
| Rocky Linux 8 | python3.12-urllib3 | 1.26.19-5.el8_10 | RLSA-2026:92474 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4650-1 |
| SLES 15 SP6 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4704-1, SUSE-SU-2026:4650-1 |
| SLES 15 SP6 | python-urllib3_1 | 1.26.18-150600.3.14.1 | SUSE-SU-2026:4948-1 |
| SLES 15 SP5 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4704-1, SUSE-SU-2026:4650-1 |
| SLES 15 SP4 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4704-1, SUSE-SU-2026:4650-1 |
| SLES 12 SP5 | python-urllib3 | 1.25.10-3.54.1 | SUSE-SU-2026:4649-1 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | python-urllib3 | 1.25.10-3.54.1 | SUSE-SU-2026:4649-1 |
| SLES 3 | python-urllib3 | 2.0.7-150400.7.36.1 | SUSE-SU-2026:4704-1 |
| SLES 3 | python-urllib3_1 | 1.26.18-150600.3.14.1 | SUSE-SU-2026:4948-1 |
| SLES for SAP 16.0 | python-urllib3 | 2.5.0-160000.8.1 | SUSE-SU-2026:24217-1 |
| SLES for SAP 16.0 | python-urllib3_1 | 1.26.20-160000.5.1 | SUSE-SU-2026:24660-1 |
| SLES for SAP 15 SP6 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4704-1, SUSE-SU-2026:4650-1 |
| SLES for SAP 15 SP6 | python-urllib3_1 | 1.26.18-150600.3.14.1 | SUSE-SU-2026:4948-1 |
| SLES for SAP 15 SP5 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4704-1, SUSE-SU-2026:4650-1 |
| SLES for SAP 15 SP4 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4704-1, SUSE-SU-2026:4650-1 |
| SLES 16.0 | python-urllib3 | 2.5.0-160000.8.1 | SUSE-SU-2026:24217-1 |
| SLES 16.0 | python-urllib3_1 | 1.26.20-160000.5.1 | SUSE-SU-2026:24660-1 |
| SLE Micro 6.2 | python-urllib3 | 2.5.0-160000.8.1 | SUSE-SU-2026:24125-1 |
| SLE Micro 5.5 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4650-1 |
| SLE Micro 5.4 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4650-1 |
| SLE Micro 5.3 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4650-1 |
| SLE HPC 15 SP5 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4704-1, SUSE-SU-2026:4650-1 |
| SLE HPC 15 SP4 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4704-1, SUSE-SU-2026:4650-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-urllib3 | 2.8.0-1.1 | openSUSE-SU-2026:12044-1 |
| openSUSE Tumbleweed | python-urllib3_1 | 1.26.20-8.1 | openSUSE-SU-2026:12119-1 |
| openSUSE Leap 16.0 | python-urllib3 | 2.5.0-160000.8.1 | openSUSE-SU-2026:22071-1 |
| openSUSE Leap 16.0 | python-urllib3_1 | 1.26.20-160000.5.1 | openSUSE-SU-2026:22252-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3-pip +1 | 21.3.1-2.amzn2023.0.22 | ALAS2023-2026-3175 |
| Amazon Linux 2023 | python3-urllib3 | 1.25.10-5.amzn2023.0.9 | ALAS2023-2026-3184 |
| Amazon Linux 2023 | python3.11-pip +1 | 22.3.1-2.amzn2023.0.15 | ALAS2023-2026-3174 |
| Amazon Linux 2023 | python3.12-pip +1 | 23.2.1-4.amzn2023.0.12 | ALAS2023-2026-3173 |
| Amazon Linux 2023 | python3.13-pip +1 | 24.2-259.amzn2023.0.9 | ALAS2023-2026-3172 |
| Amazon Linux 2023 | python3.14-pip +1 | 26.1.1-1.amzn2023.0.4 | ALAS2023-2026-3171 |
| Amazon Linux 2 | python-urllib3 | 1.25.9-1.amzn2.0.11 | ALAS2-2026-3973 |
| Amazon Linux 2 | python2-pip +2 | 20.2.2-1.amzn2.0.19 | ALAS2-2026-3974 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-urllib3 | 2.0.7-7 | — |
| Azure Linux 3 | tensorflow | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | python3-urllib3 | 1.26.19-4.el10_2.2 | ELSA-2026-85930 |
| Oracle Linux 10 | python3.14-urllib3 | 2.6.3-2.el10_2.6 | ELSA-2026-84578 |
| Oracle Linux 9 | python3-urllib3 | 1.26.5-8.el9_8.2 | ELSA-2026-90494 |
| Oracle Linux 9 | python3.12-urllib3 | 1.26.19-3.el9_8.2 | ELSA-2026-85929 |
| Oracle Linux 9 | python3.14-urllib3 | 2.6.3-2.el9_8.6 | ELSA-2026-84577 |
| Oracle Linux 8 | python3-urllib3 | 1.24.2-11.el8_10 | ELSA-2026-90759 |
| Oracle Linux 8 | python3.12-urllib3 | 1.26.19-5.el8_10 | ELSA-2026-92474 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | confluent-docker-utils | 0.0.172-r4 | — |
| Wolfi rolling | datadog-agent-7.77-core-integrations | 7.77.3-r27 | — |
| Wolfi rolling | datadog-agent-7.78 | 7.78.4-r23 | — |
| Wolfi rolling | datadog-agent-7.79 +5 | No fix yet | — |
| Wolfi rolling | datadog-agent-7.81 | 7.81.3-r10 | — |
| Wolfi rolling | jwt-tool | 2.3.0-r7 | — |
| Wolfi rolling | kserve-storage-controller | 0.21.0-r2 | — |
| Wolfi rolling | kubeflow-pipelines-apiserver | 2.17.2-r8 | — |
| Wolfi rolling | kubeflow-pipelines-visualization-server | 2.17.2-r4 | — |
| Wolfi rolling | open-webui | 0.11.4-r3 | — |
| Wolfi rolling | py3-cassandra-medusa | 0.30.1-r2 | — |
| Wolfi rolling | py3.10-pip-base +4 | 26.2.1-r2 | — |
| Wolfi rolling | py3.10-pipenv +3 | 2026.8.0-r2 | — |
| Wolfi rolling | pypy-3.10 | 7.3.19-r21 | — |
| Wolfi rolling | superset-6.0 | 6.0.0-r18 | — |
| Wolfi rolling | superset-6.1 | 6.1.0-r11 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | urllib3 | >= 1.10.3, < 2.8.0 | 2.8.0 | GHSA-vxq7-64xx-v4gw |
Advisories 46
- WID-SEC-2026-4111 Red Hat Ansible Automation Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- WID-SEC-2026-4024 Red Hat Quay und Enterprise Linux (pypdf, urllib3, URI): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- SUSE-SU-2026:24660-1 Security update for python-urllib3_1 SUSE / openSUSE Security Updates · Nov 12, 2026
- openSUSE-SU-2026:22252-1 Security update for python-urllib3_1 SUSE / openSUSE Security Updates · Nov 11, 2026
- RLSA-2026:85930 Important: python-urllib3 security update Rocky Linux Security Advisories · Nov 3, 2026
- SUSE-SU-2026:4948-1 Security update for python-urllib3_1 SUSE / openSUSE Security Updates · Nov 2, 2026
- RLSA-2026:92474 Important: python3.12-urllib3 security update Rocky Linux Security Advisories · Oct 30, 2026
- ALSA-2026:92474 Important: python3.12-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- RLSA-2026:90494 Important: python-urllib3 security update Rocky Linux Security Advisories · Oct 29, 2026
- RLSA-2026:90759 Important: python-urllib3 security update Rocky Linux Security Advisories · Oct 29, 2026
- ALSA-2026:85929 Important: python3.12-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:84577 Important: python3.14-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:90494 Important: python-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:84578 Important: python3.14-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:85930 Important: python-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:90759 Important: python-urllib3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ELSA-2026-92474 Important: python3.12-urllib3 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 29, 2026
- ELSA-2026-90759 Important: python-urllib3 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 27, 2026
- ELSA-2026-90494 Important: python-urllib3 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 26, 2026
- RLSA-2026:85929 Important: python3.12-urllib3 security update Rocky Linux Security Advisories · Oct 22, 2026
- SUSE-SU-2026:24217-1 Security update for python-urllib3 SUSE / openSUSE Security Updates · Oct 21, 2026
- RLSA-2026:84577 Important: python3.14-urllib3 security update Rocky Linux Security Advisories · Oct 20, 2026
- RLSA-2026:84578 Important: python3.14-urllib3 security update Rocky Linux Security Advisories · Oct 20, 2026
- RHSA-2026:84577 Red Hat Security Advisory: python3.14-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:84578 Red Hat Security Advisory: python3.14-urllib3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:69612 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- ELSA-2026-85929 Important: python3.12-urllib3 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 20, 2026
- ELSA-2026-85930 Important: python-urllib3 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 20, 2026
- openSUSE-SU-2026:22071-1 Security update for python-urllib3 SUSE / openSUSE Security Updates · Oct 19, 2026
- ELSA-2026-84578 Important: python3.14-urllib3 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 19, 2026
- ELSA-2026-84577 Important: python3.14-urllib3 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 19, 2026
- USN-8926-1 python-urllib3 vulnerabilities Ubuntu Security Notices (USN) · Oct 17, 2026
- SUSE-SU-2026:4704-1 Security update for python-urllib3 SUSE / openSUSE Security Updates · Oct 17, 2026
- SUSE-SU-2026:4649-1 Security update for python-urllib3 SUSE / openSUSE Security Updates · Oct 14, 2026
- SUSE-SU-2026:4650-1 Security update for python-urllib3 SUSE / openSUSE Security Updates · Oct 14, 2026
- openSUSE-SU-2026:12119-1 python313-urllib3_1-1.26.20-8.1 on GA media SUSE / openSUSE Security Updates · Oct 14, 2026
- SUSE-SU-2026:24125-1 Security update for python-urllib3 SUSE / openSUSE Security Updates · Oct 13, 2026
- ALAS2-2026-3973 Important: python-urllib3 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 12, 2026
- ALAS2-2026-3974 Important: python-pip security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 12, 2026
- ALAS2023-2026-3172 Important: python3.13-pip security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 12, 2026
- ALAS2023-2026-3173 Important: python3.12-pip security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 12, 2026
- ALAS2023-2026-3174 Important: python3.11-pip security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 12, 2026
- ALAS2023-2026-3175 Important: python-pip security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 12, 2026
- ALAS2023-2026-3184 Important: python-urllib3 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 12, 2026
- ALAS2023-2026-3171 Important: python3.14-pip security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 12, 2026
- openSUSE-SU-2026:12044-1 python313-urllib3-2.8.0-1.1 on GA media SUSE / openSUSE Security Updates · Oct 5, 2026