Critical Security Update for python3.11-urllib3: Addressing Multiple Vulnerabilities
Summary
RHSA-2026:1546: Red Hat Security Advisory: python3.11-urllib3 security update. Affects python3.11-urllib3 versions < 0:1.26.12-1.el9_2.2. Fixed in 0:1.26.12-1.el9_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python3.11-urllib3 is a widely used HTTP client for Python, designed to simplify the process of making HTTP requests. It provides essential features such as connection pooling, client-side SSL/TLS verification, and support for various HTTP methods. However, vulnerabilities in this package can lead to significant security risks, including data exposure and denial of service, necessitating timely updates to maintain application integrity.
Vulnerability Detail
The vulnerabilities identified in python3.11-urllib3, including CVE-2025-66418, CVE-2025-66471, and CVE-2026-21441, stem from flaws in the library's handling of HTTP requests and responses. These issues can allow attackers to exploit the library, potentially leading to unauthorized access to sensitive data or service disruptions. The vulnerabilities have been assigned a CVSS score of 7.5, indicating a high severity level that requires immediate attention.
How To Fix
Minimum fixed version
0:1.26.12-1.el9_2.2
This is the first release that contains the fix.
sudo dnf update python3.11-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the usage of python3.11-urllib3 in your application until the update is applied. This can be done by modifying your code to avoid using the affected features or by switching to an alternative HTTP client library that does not have these vulnerabilities.
Conclusion
The vulnerabilities in python3.11-urllib3 pose significant risks to applications utilizing this library. It is crucial to update to the patched version to mitigate these risks effectively. Users should also consider utilizing tools like Vulert to monitor and alert for open-source vulnerabilities in their software.
See every vulnerability recorded for python3.11-urllib3 →
FAQ
The vulnerabilities include issues that can lead to unauthorized data access and potential denial of service, as detailed in CVE-2025-66418, CVE-2025-66471, and CVE-2026-21441.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
The vulnerabilities have a CVSS score of 7.5, indicating a high severity level that requires prompt action.
If an immediate update is not possible, consider implementing workarounds, such as restricting the use of the affected library or switching to an alternative HTTP client.
Additional information can be found in the Red Hat Security Advisory and the respective CVE entries for detailed technical descriptions.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11-urllib3.
