Critical Security Update for python3.12-urllib3: Addressing Denial of Service and Information Disclosure Vulnerabilities
Summary
ALSA-2026:28159: Important: python3.12-urllib3 security update. Affects python3.12-urllib3 versions < 1.26.19-3.el9_8. Fixed in 1.26.19-3.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted programming language known for its versatility and ease of use. The urllib3 library, part of the Python ecosystem, is a powerful HTTP client for making requests and handling responses. It supports features like connection pooling, client-side SSL/TLS verification, and file uploads. However, vulnerabilities in urllib3 can lead to severe security issues, including denial of service and information disclosure, which can compromise the integrity and confidentiality of applications relying on this library.
Vulnerability Detail
The vulnerabilities identified in python3.12-urllib3 include a Denial of Service (DoS) due to excessive HTTP response decompression (CVE-2026-44432) and information disclosure via cross-origin redirects that forward sensitive headers (CVE-2026-44431). These issues arise from improper handling of HTTP responses, which can be exploited by attackers to disrupt service availability or expose sensitive information. The ramifications of these vulnerabilities can be significant, potentially leading to service outages or unauthorized access to sensitive data.
How To Fix
Minimum fixed version
1.26.19-3.el9_8
This is the first release that contains the fix.
sudo dnf update python3.12-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing rate limiting on HTTP requests to mitigate the impact of potential denial of service attacks. Additionally, review your application's handling of cross-origin requests to ensure sensitive headers are not inadvertently exposed.
Conclusion
The vulnerabilities in python3.12-urllib3 pose significant risks to applications utilizing this library. It is crucial to apply the necessary updates to mitigate these risks and ensure the security of your applications. By staying informed and proactive, you can protect your systems from potential exploits.
See every vulnerability recorded for python3.12-urllib3 →
FAQ
The vulnerabilities can lead to denial of service, making applications unresponsive, and information disclosure, potentially exposing sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Implement rate limiting and review cross-origin request handling as temporary workarounds until you can apply the update.
Detailed information can be found on the CVE pages for CVE-2026-44431 and CVE-2026-44432.
Updating the package should not result in data loss, but it is always advisable to back up your application before making changes.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-urllib3.
