Critical Security Update for python3.14-urllib3: Addressing Denial of Service and Traffic Interception Vulnerabilities
Summary
ALSA-2026:84577: Important: python3.14-urllib3 security update. Affects python3.14-urllib3 versions < 2.6.3-2.el9_8.6. Fixed in 2.6.3-2.el9_8.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3.14-urllib3 is a widely used library in Python that facilitates HTTP requests, providing essential features such as connection pooling, client-side SSL verification, and support for various HTTP methods. It is integral for applications that require reliable and efficient web communication. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this library.
Vulnerability Detail
The vulnerabilities in python3.14-urllib3 stem from two critical issues: first, a Denial of Service (DoS) vulnerability caused by unbounded memory allocation in the chunk parser (CVE-2026-97689), which could lead to application crashes or excessive resource consumption. Second, a traffic interception vulnerability (CVE-2026-97687) allows an attacker to override TLS configurations for HTTPS proxies, potentially exposing sensitive data to unauthorized parties. These vulnerabilities pose significant risks to the integrity and confidentiality of data transmitted over the network.
How To Fix
Minimum fixed version
2.6.3-2.el9_8.6
This is the first release that contains the fix.
sudo dnf update python3.14-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the use of HTTP proxies or implementing strict validation of TLS configurations until the package can be updated. This can help mitigate the risks associated with the traffic interception vulnerability.
Conclusion
In summary, the vulnerabilities identified in python3.14-urllib3 pose significant risks to applications relying on this library for HTTP communication. It is crucial to update to the patched version to mitigate these risks and ensure the security of your applications.
See every vulnerability recorded for python3.14-urllib3 →
FAQ
The Denial of Service vulnerability can lead to application crashes or excessive memory usage, potentially making the application unavailable to users.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, consider implementing workarounds such as disabling HTTP proxies or ensuring strict TLS validation.
While specific exploits may not be publicly available, the nature of these vulnerabilities suggests that they could be exploited by attackers to compromise application security.
For more details, refer to the CVE pages listed in the vulnerability report, which provide in-depth information about the issues and their implications.
Related vulnerabilities
Recent vulnerabilities recorded for python3.14-urllib3.
