Critical Security Update for python3-urllib3: Addressing Denial of Service and Information Disclosure Vulnerabilities
Summary
ALSA-2026:28158: Important: python-urllib3 security update. Affects python3-urllib3 versions < 1.26.5-8.el9_8. Fixed in 1.26.5-8.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python3-urllib3 is a powerful HTTP client for Python that provides features such as connection pooling, client-side SSL/TLS verification, and support for various HTTP methods. It is widely used in web applications and services for making HTTP requests. However, recent vulnerabilities have been identified that could compromise the security of applications utilizing this package.
Vulnerability Detail
The vulnerabilities in python3-urllib3 stem from two primary issues: a Denial of Service (DoS) vulnerability caused by excessive HTTP response decompression (CVE-2026-44432) and an Information Disclosure vulnerability that allows sensitive headers to be forwarded through cross-origin redirects (CVE-2026-44431). These vulnerabilities can lead to service interruptions and unauthorized access to sensitive information, posing significant risks to applications relying on this library.
How To Fix
Minimum fixed version
1.26.5-8.el9_8
This is the first release that contains the fix.
sudo dnf update python3-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement rate limiting on HTTP responses to mitigate the risk of Denial of Service attacks. Additionally, review your application’s handling of cross-origin requests to ensure sensitive headers are not exposed.
Conclusion
The vulnerabilities identified in python3-urllib3 pose serious risks to applications using this library. It is crucial to update to the latest version to protect against potential Denial of Service and Information Disclosure attacks. Implementing workarounds can provide temporary relief, but a full update is the best course of action.
See every vulnerability recorded for python3-urllib3 →
FAQ
The Denial of Service vulnerability can lead to service outages, making your application unavailable to users.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, consider implementing workarounds such as rate limiting and reviewing cross-origin request handling.
While specific exploits may not be publicly disclosed, the vulnerabilities present significant risks that could be exploited by attackers.
For detailed information, refer to the CVE pages: CVE-2026-44431 and CVE-2026-44432.
Related vulnerabilities
Recent vulnerabilities recorded for python3-urllib3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
