Critical Security Flaw in python3.12-urllib3: Denial of Service and Information Disclosure
Summary
RLSA-2026:32992: Important: python3.12-urllib3 security update. Affects python3.12-urllib3 versions < 0:1.26.19-3.el8_10. Fixed in 0:1.26.19-3.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3.12-urllib3 is a widely used library in Python for handling HTTP requests. It provides essential features such as connection pooling, client-side SSL verification, and support for various HTTP methods. However, vulnerabilities in urllib3 can lead to severe security issues, including denial of service and information disclosure, which can compromise the integrity and confidentiality of applications relying on this library.
Vulnerability Detail
The vulnerability stems from two critical issues in urllib3. The first issue (CVE-2026-44432) allows for a denial of service due to excessive HTTP response decompression, which can lead to resource exhaustion on the server. The second issue (CVE-2026-44431) involves information disclosure through cross-origin redirects that can inadvertently forward sensitive headers, potentially exposing confidential information to unauthorized parties. These vulnerabilities can have significant ramifications, especially for applications that handle sensitive data.
How To Fix
Minimum fixed version
0:1.26.19-3.el8_10
This is the first release that contains the fix.
sudo dnf update python3.12-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement strict input validation and limit the size of HTTP responses your application processes. This can help mitigate the risk of denial of service attacks until the package is updated.
Conclusion
In summary, the vulnerabilities in python3.12-urllib3 pose significant risks that can affect the security and functionality of applications. It is crucial to update to the latest patched version to safeguard against denial of service and information disclosure threats. Utilizing tools like Vulert can help in monitoring and managing these vulnerabilities effectively.
See every vulnerability recorded for python3.12-urllib3 →
FAQ
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerabilities can lead to denial of service, causing applications to become unresponsive, and information disclosure, which can expose sensitive data.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If an immediate update is not possible, implement input validation and limit HTTP response sizes as a temporary measure to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-urllib3.
