Critical Security Vulnerability in python3.14-urllib3: Denial of Service and Information Disclosure
Summary
RLSA-2026:27929: Important: python3.14-urllib3 security update. Affects python3.14-urllib3 versions < 0:2.6.3-2.el10_2. Fixed in 0:2.6.3-2.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3.14-urllib3 is a widely used library in the Python programming ecosystem that facilitates HTTP requests. It provides essential features such as connection pooling, client-side SSL verification, and support for various HTTP methods. However, like any software, it can be susceptible to vulnerabilities that may compromise its functionality and security.
Vulnerability Detail
The vulnerabilities identified in python3.14-urllib3 include a Denial of Service (DoS) due to excessive HTTP response decompression (CVE-2026-44432) and information disclosure via cross-origin redirects that can forward sensitive headers (CVE-2026-44431). These vulnerabilities can lead to service interruptions and unauthorized access to sensitive information, posing significant risks to applications relying on this library.
How To Fix
Minimum fixed version
0:2.6.3-2.el10_2
This is the first release that contains the fix.
sudo dnf update python3.14-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing rate limiting on your HTTP requests to mitigate the risk of Denial of Service attacks. Additionally, review your application's handling of cross-origin requests to prevent sensitive information from being exposed.
Conclusion
The vulnerabilities in python3.14-urllib3 pose significant risks, including Denial of Service and information disclosure. It is crucial to update to the patched version to safeguard your applications. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for python3.14-urllib3 →
FAQ
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerabilities can lead to service disruptions and unauthorized access to sensitive data, which can compromise the integrity and confidentiality of your application.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If immediate updates are not possible, implement workarounds such as rate limiting and reviewing cross-origin request handling to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for python3.14-urllib3.
