Critical Security Flaw in python3.14-urllib3: Denial of Service and Traffic Interception
Summary
RLSA-2026:84578: Important: python3.14-urllib3 security update. Affects python3.14-urllib3 versions < 0:2.6.3-2.el10_2.6. Fixed in 0:2.6.3-2.el10_2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3.14-urllib3 is a widely used library in Python for handling HTTP requests. It provides features such as connection pooling, client-side SSL verification, and support for various HTTP features. However, vulnerabilities in this library can lead to severe security risks, including denial of service and unauthorized traffic interception.
Vulnerability Detail
The vulnerability stems from two critical issues in urllib3. The first issue (CVE-2026-97689) allows for a denial of service via unbounded memory allocation in the chunk parser, which can lead to application crashes or resource exhaustion. The second issue (CVE-2026-97687) involves traffic interception through a misconfigured HTTPS proxy TLS, potentially allowing attackers to intercept sensitive data. Both vulnerabilities pose significant risks to applications relying on urllib3 for secure communications.
How To Fix
Minimum fixed version
0:2.6.3-2.el10_2.6
This is the first release that contains the fix.
sudo dnf update python3.14-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the use of chunked transfer encoding in your HTTP requests or avoid using HTTPS proxies until the package is updated.
Conclusion
In summary, the vulnerabilities in python3.14-urllib3 pose significant security risks that can lead to denial of service and traffic interception. It is crucial to update the package to the latest patched version to safeguard your applications. Utilize tools like Vulert for ongoing monitoring of vulnerabilities.
See every vulnerability recorded for python3.14-urllib3 →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The potential impacts include denial of service, application crashes, and unauthorized interception of sensitive data.
Yes, if an attacker successfully exploits the traffic interception vulnerability, there is a risk of sensitive data being exposed or lost.
If you cannot update the package immediately, consider implementing the suggested workaround to mitigate the risks until an update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.14-urllib3.
