Critical Security Update for python3.12-urllib3: Addressing Denial of Service and Traffic Interception Vulnerabilities
Summary
ALSA-2026:85929: Important: python3.12-urllib3 security update. Affects python3.12-urllib3 versions < 1.26.19-3.el9_8.2. Fixed in 1.26.19-3.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a versatile, high-level programming language known for its ease of use and extensive libraries. One of these libraries, urllib3, is widely utilized for making HTTP requests in Python applications. It provides features such as connection pooling, client-side SSL/TLS verification, and support for HTTP/1.1 and HTTP/2. However, vulnerabilities in urllib3 can lead to severe security risks, including denial of service and traffic interception, which can compromise the integrity and availability of applications relying on this library.
Vulnerability Detail
The vulnerabilities identified in python3.12-urllib3 include a Denial of Service (DoS) issue caused by unbounded memory allocation in the chunk parser (CVE-2026-97689) and a traffic interception vulnerability that arises from an HTTPS proxy TLS configuration override (CVE-2026-97687). These vulnerabilities can allow attackers to exploit the library, potentially leading to application crashes or unauthorized access to sensitive data.
How To Fix
Minimum fixed version
1.26.19-3.el9_8.2
This is the first release that contains the fix.
sudo dnf update python3.12-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the memory allocation in your application or avoid using the affected features of urllib3 until the package is updated. However, this is not a permanent solution and updating the package is highly recommended.
Conclusion
The vulnerabilities in python3.12-urllib3 pose significant risks to applications utilizing this library. It is crucial to update to the latest patched version to safeguard against potential attacks. Regular monitoring and proactive security measures are essential to maintain application integrity.
See every vulnerability recorded for python3.12-urllib3 →
FAQ
Urllib3 is a powerful HTTP library for Python that simplifies making HTTP requests and handling responses.
The vulnerabilities can lead to denial of service, causing applications to crash, and allow attackers to intercept traffic, potentially compromising sensitive data.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
While temporary workarounds exist, such as limiting memory allocation, the best course of action is to update to the patched version of the package.
If immediate updates are not possible, ensure to monitor your application closely for any unusual behavior and consider implementing additional security measures.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-urllib3.
