Critical Security Update for python3.14-urllib3: Denial of Service and Traffic Interception Vulnerabilities
Summary
ALSA-2026:84578: Important: python3.14-urllib3 security update. Affects python3.14-urllib3 versions < 2.6.3-2.el10_2.6. Fixed in 2.6.3-2.el10_2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted programming language known for its versatility and ease of use. The urllib3 module is a powerful HTTP client for Python, providing features such as connection pooling, client-side SSL/TLS verification, and support for HTTP/1.1 and HTTP/2. However, vulnerabilities in urllib3 can lead to severe security issues, including denial of service and traffic interception, which can compromise the integrity and confidentiality of data transmitted over the network.
Vulnerability Detail
The vulnerabilities in python3.14-urllib3 stem from two critical issues: first, a denial of service vulnerability caused by unbounded memory allocation in the chunk parser (CVE-2026-97689), which could allow an attacker to exhaust system memory and crash the application. Second, a traffic interception vulnerability (CVE-2026-97687) arises from improper handling of HTTPS proxy TLS configurations, potentially allowing attackers to intercept and manipulate secure communications. These vulnerabilities can have serious ramifications, including unauthorized access to sensitive data and service disruptions.
How To Fix
Minimum fixed version
2.6.3-2.el10_2.6
This is the first release that contains the fix.
sudo dnf update python3.14-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider disabling the use of HTTPS proxies until the package can be updated. This can be done by configuring your application to bypass proxy settings or by using a different HTTP client that does not exhibit these vulnerabilities.
Conclusion
The vulnerabilities in python3.14-urllib3 present serious security risks that can lead to denial of service and traffic interception. It is crucial to update to the patched version to safeguard your applications. Regular monitoring of dependencies using tools like Vulert can help maintain security and prevent future vulnerabilities.
See every vulnerability recorded for python3.14-urllib3 →
FAQ
The denial of service vulnerability can lead to application crashes due to excessive memory consumption, resulting in service unavailability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing workarounds such as disabling HTTPS proxy usage to mitigate risks.
While specific exploits may not be publicly disclosed, the vulnerabilities pose significant risks that could be exploited by attackers to compromise systems.
It is advisable to regularly check for vulnerabilities in your dependencies, ideally on a weekly basis, to ensure your software remains secure.
Related vulnerabilities
Recent vulnerabilities recorded for python3.14-urllib3.
