Critical Security Flaw in python3.12-urllib3: Denial of Service and Traffic Interception Risks
Summary
RLSA-2026:85929: Important: python3.12-urllib3 security update. Affects python3.12-urllib3 versions < 0:1.26.19-3.el9_8.2. Fixed in 0:1.26.19-3.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3.12-urllib3 is a widely used library in Python for making HTTP requests. It simplifies the process of sending and receiving data over the web, providing features like connection pooling, client-side SSL verification, and support for various protocols. However, vulnerabilities in this library can lead to significant security risks, including denial of service attacks and unauthorized traffic interception.
Vulnerability Detail
The vulnerabilities identified in python3.12-urllib3 include a denial of service (DoS) risk due to unbounded memory allocation in the chunk parser (CVE-2026-97689) and a potential traffic interception issue caused by an HTTPS proxy TLS configuration override (CVE-2026-97687). These vulnerabilities can allow attackers to exploit the library to consume excessive memory resources or intercept sensitive data, posing serious threats to applications relying on this library.
How To Fix
Minimum fixed version
0:1.26.19-3.el9_8.2
This is the first release that contains the fix.
sudo dnf update python3.12-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the memory allocation for your application or implementing additional security measures to monitor and control traffic through your application. However, updating to the patched version is the recommended approach.
Conclusion
The vulnerabilities in python3.12-urllib3 pose significant risks, including denial of service and traffic interception. It is crucial to update to the patched version to mitigate these risks. Utilizing tools like Vulert can help monitor your dependencies for vulnerabilities effectively.
See every vulnerability recorded for python3.12-urllib3 →
FAQ
The CVSS score for this vulnerability is 7.5, indicating a high level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerabilities can lead to denial of service attacks, causing your application to become unresponsive, and allow attackers to intercept sensitive data transmitted over HTTPS.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If you cannot update the package immediately, implement security measures to limit memory usage and monitor traffic closely until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-urllib3.
