Critical Security Update for python3-urllib3: Addressing Denial of Service and Information Disclosure Vulnerabilities
Summary
ALSA-2026:28000: Important: python-urllib3 security update. Affects python3-urllib3 versions < 1.26.19-4.el10_2. Fixed in 1.26.19-4.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python3-urllib3 is a widely used HTTP library for Python that enables users to send HTTP requests and handle responses efficiently. It is designed to provide a simple interface for making HTTP requests, managing connections, and handling various protocols. However, vulnerabilities in urllib3 can lead to severe security risks, including denial of service and information disclosure, which can compromise the integrity and confidentiality of applications relying on this library.
Vulnerability Detail
The vulnerabilities identified in python3-urllib3 include a Denial of Service (DoS) due to excessive HTTP response decompression (CVE-2026-44432) and an Information Disclosure issue via cross-origin redirects that can forward sensitive headers (CVE-2026-44431). These vulnerabilities can be exploited by attackers to disrupt service availability or leak sensitive information, posing significant risks to applications that utilize this library.
How To Fix
Minimum fixed version
1.26.19-4.el10_2
This is the first release that contains the fix.
sudo dnf update python3-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the size of HTTP responses that their applications will process, thereby mitigating the risk of denial of service attacks. This can be done by configuring the application to set a maximum response size threshold.
Conclusion
The vulnerabilities in python3-urllib3 pose significant risks that can affect the availability and confidentiality of applications. It is crucial for users to update to the latest patched version to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for python3-urllib3 →
FAQ
The vulnerabilities can lead to denial of service, making applications unresponsive, and can also result in sensitive information being disclosed to unauthorized parties.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If an immediate update is not possible, consider implementing the suggested workaround to limit HTTP response sizes until you can apply the patch.
While specific exploits may not be publicly disclosed, the nature of the vulnerabilities suggests that they could be exploited by attackers to disrupt services or access sensitive data.
For more details, refer to the CVE pages: CVE-2026-44431 and CVE-2026-44432, which provide comprehensive information about the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for python3-urllib3.
