Critical Security Flaws in python3.14-urllib3: Denial of Service and Information Disclosure
Summary
RLSA-2026:28157: Important: python3.14-urllib3 security update. Affects python3.14-urllib3 versions < 0:2.6.3-2.el9_8. Fixed in 0:2.6.3-2.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3.14-urllib3 is a widely used library in Python for handling HTTP requests. It provides essential features such as connection pooling, client-side SSL verification, and support for various HTTP methods. However, due to its extensive use in web applications, it is crucial to address any security vulnerabilities that may arise. The recent vulnerabilities identified in urllib3 could potentially compromise the security of applications relying on this library.
Vulnerability Detail
The vulnerabilities in python3.14-urllib3 include a Denial of Service (DoS) due to excessive HTTP response decompression (CVE-2026-44432) and an Information Disclosure issue via cross-origin redirects that could forward sensitive headers (CVE-2026-44431). The DoS vulnerability allows attackers to exploit the library by sending specially crafted responses that consume excessive resources, leading to service unavailability. The Information Disclosure vulnerability can expose sensitive information, such as authentication tokens, by improperly handling cross-origin requests.
How To Fix
Minimum fixed version
0:2.6.3-2.el9_8
This is the first release that contains the fix.
sudo dnf update python3.14-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing strict validation of HTTP responses and headers in your application to mitigate the risk of denial of service and information disclosure until the package can be updated.
Conclusion
The vulnerabilities in python3.14-urllib3 pose significant risks, including denial of service and information disclosure. It is essential to update to the latest patched version to safeguard your applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python3.14-urllib3 →
FAQ
The CVSS score for the vulnerabilities in python3.14-urllib3 is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without requiring any signup.
The vulnerabilities can lead to service disruptions due to denial of service attacks and potential exposure of sensitive information, which can compromise user security.
Yes, the vulnerabilities are fixed in version 0:2.6.3-2.el9_8 of python3.14-urllib3.
If an immediate update is not possible, implement strict validation of HTTP responses and headers as a temporary measure to reduce risk.
Related vulnerabilities
Recent vulnerabilities recorded for python3.14-urllib3.
