Critical Security Flaw in python3.14-urllib3: Denial of Service and Traffic Interception Risks
Summary
RLSA-2026:84577: Important: python3.14-urllib3 security update. Affects python3.14-urllib3 versions < 0:2.6.3-2.el9_8.6. Fixed in 0:2.6.3-2.el9_8.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3.14-urllib3 is a widely used library in Python for making HTTP requests. It provides a powerful interface for handling URL requests, managing connections, and ensuring secure data transmission. However, vulnerabilities in this library can lead to severe security risks, including denial of service and potential traffic interception, which can compromise sensitive data.
Vulnerability Detail
The vulnerabilities identified in python3.14-urllib3 include a Denial of Service (DoS) vulnerability due to unbounded memory allocation in the chunk parser (CVE-2026-97689) and a traffic interception risk via HTTPS proxy TLS configuration override (CVE-2026-97687). These vulnerabilities can allow attackers to exploit the library, leading to service disruptions and unauthorized access to data transmitted over HTTPS.
How To Fix
Minimum fixed version
0:2.6.3-2.el9_8.6
This is the first release that contains the fix.
sudo dnf update python3.14-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the use of HTTPS proxies until the package is updated. This can help mitigate the risk of traffic interception while you work on applying the necessary updates.
Conclusion
The vulnerabilities in python3.14-urllib3 pose significant risks to applications relying on this library for HTTP requests. It is crucial to update to the patched version to safeguard against potential denial of service and traffic interception attacks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for python3.14-urllib3 →
FAQ
The CVSS score of the vulnerabilities in python3.14-urllib3 is 7.5, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities without any installation.
The vulnerabilities can lead to denial of service, causing application downtime, and allow attackers to intercept sensitive data transmitted over HTTPS, compromising user privacy and security.
Yes, temporarily disabling the use of HTTPS proxies can help mitigate the risk of traffic interception until the package is updated.
For more details, refer to the CVE pages listed in the vulnerability report, which provide comprehensive information about the security issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.14-urllib3.
