Critical Security Vulnerability in python3.11-urllib3: Update Required
Summary
RHSA-2026:1712: Red Hat Security Advisory: python3.11-urllib3 security update. Affects python3.11-urllib3 versions < 0:1.26.12-2.el9_4.3. Fixed in 0:1.26.12-2.el9_4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python3.11-urllib3 is a widely used HTTP client library for Python, enabling developers to send HTTP requests and handle responses effectively. It is known for its simplicity and ease of use, making it a popular choice for web applications. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this library.
Vulnerability Detail
The vulnerabilities identified as CVE-2025-66418, CVE-2025-66471, and CVE-2026-21441 expose the python3.11-urllib3 package to potential security risks. These vulnerabilities could allow attackers to exploit weaknesses in the library, leading to unauthorized access or denial of service. The vulnerabilities stem from flaws in the library's handling of certain HTTP requests, which could be manipulated by malicious actors to execute harmful actions.
How To Fix
Minimum fixed version
0:1.26.12-2.el9_4.3
This is the first release that contains the fix.
sudo dnf update python3.11-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation and sanitization on all HTTP requests processed by your application to mitigate potential exploitation of the vulnerabilities.
Conclusion
The identified vulnerabilities in python3.11-urllib3 pose significant risks to applications relying on this library. It is crucial to update to the patched version to ensure the security of your applications. Regular monitoring and prompt action are essential to maintain a secure software environment.
See every vulnerability recorded for python3.11-urllib3 →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Failure to address this vulnerability may lead to unauthorized access, data breaches, or service disruptions in applications utilizing the affected library.
Yes, Vulert provides a service that monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If an immediate update is not possible, implement input validation and sanitization on HTTP requests to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11-urllib3.
