Critical Security Flaw in python3-urllib3: Denial of Service and Traffic Interception Risks
Summary
ALSA-2026:85930: Important: python-urllib3 security update. Affects python3-urllib3 versions < 1.26.19-4.el10_2.2. Fixed in 1.26.19-4.el10_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python3-urllib3 is a widely used HTTP client for Python that provides powerful features for making HTTP requests, including connection pooling, client-side SSL/TLS verification, and support for various protocols. It is integral to many applications that require reliable and secure web communication. However, recent vulnerabilities have exposed it to significant risks, including denial of service and potential traffic interception.
Vulnerability Detail
The vulnerabilities identified in python3-urllib3 stem from two main issues: first, a Denial of Service (DoS) vulnerability caused by unbounded memory allocation in the chunk parser (CVE-2026-97689), which can lead to application crashes or slowdowns under specific conditions. Second, there is a traffic interception vulnerability (CVE-2026-97687) that arises from improper handling of HTTPS proxy TLS configurations, allowing attackers to intercept and manipulate traffic. These vulnerabilities can severely compromise the integrity and availability of applications relying on urllib3 for secure communications.
How To Fix
Minimum fixed version
1.26.19-4.el10_2.2
This is the first release that contains the fix.
sudo dnf update python3-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing network-level security measures such as firewalls to restrict access to vulnerable endpoints and monitoring traffic for unusual patterns that may indicate exploitation attempts.
Conclusion
The vulnerabilities in python3-urllib3 present significant risks, including denial of service and traffic interception. It is imperative for users to update to the latest patched version to safeguard their applications. Implementing workarounds and monitoring tools like Vulert can provide additional layers of security while updates are being applied.
See every vulnerability recorded for python3-urllib3 →
FAQ
The Denial of Service vulnerability can lead to application crashes or significant slowdowns, affecting the availability of services that rely on urllib3.
Traffic interception can allow attackers to capture and manipulate sensitive data transmitted between clients and servers, compromising data integrity and confidentiality.
Yes, applications using older versions of urllib3 are at risk of exploitation through the identified vulnerabilities. It is crucial to update to the latest patched version.
Implement network security measures such as firewalls and traffic monitoring to mitigate risks until you can apply the necessary updates.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for python3-urllib3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
