Critical Security Update for python3.12-urllib3: Addressing Denial of Service and Information Disclosure Vulnerabilities
Summary
ALSA-2026:32992: Important: python3.12-urllib3 security update. Affects python3.12-urllib3 versions < 1.26.19-3.el8_10. Fixed in 1.26.19-3.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3.12-urllib3 is a widely used library in the Python programming ecosystem that facilitates HTTP requests and responses. It is known for its ease of use, flexibility, and support for various features such as connection pooling, file uploads, and more. However, vulnerabilities in this library can lead to severe security issues, impacting applications that rely on it for web communication.
Vulnerability Detail
The vulnerabilities identified in python3.12-urllib3 include a Denial of Service (DoS) due to excessive HTTP response decompression (CVE-2026-44432) and an Information Disclosure issue via cross-origin redirects that can forward sensitive headers (CVE-2026-44431). These vulnerabilities can allow attackers to exploit the library, potentially leading to service outages or unauthorized access to sensitive information.
How To Fix
Minimum fixed version
1.26.19-3.el8_10
This is the first release that contains the fix.
sudo dnf update python3.12-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing rate limiting on HTTP responses to mitigate the risk of DoS attacks. Additionally, review and sanitize any headers that may be forwarded in cross-origin requests to prevent information leakage.
Conclusion
The vulnerabilities in python3.12-urllib3 pose significant risks to applications relying on this library. It is crucial to update to the patched version to safeguard against potential attacks. Implementing workarounds can provide temporary relief, but a permanent fix through updating is recommended.
See every vulnerability recorded for python3.12-urllib3 →
FAQ
The Denial of Service vulnerability can cause applications to become unresponsive, leading to service outages and a poor user experience.
You can use Vulert, which monitors open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without any signup.
The Information Disclosure vulnerability can expose sensitive information, such as authentication tokens or user data, to unauthorized parties, which can lead to further security breaches.
Implementing rate limiting and sanitizing headers in cross-origin requests can help mitigate risks until the package is updated.
Detailed information about the vulnerabilities can be found on the CVE pages for CVE-2026-44431 and CVE-2026-44432.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-urllib3.
