Critical Security Update for python3.14-urllib3: Addressing Vulnerabilities CVE-2026-97687 and CVE-2026-97689
Summary
RHSA-2026:84578: Red Hat Security Advisory: python3.14-urllib3 security update. Affects python3.14-urllib3 versions < 0:2.6.3-2.el10_2.6. Fixed in 0:2.6.3-2.el10_2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
python3.14-urllib3 is a widely used HTTP client library for Python, designed to facilitate the management of HTTP connections and requests. It provides essential features such as connection pooling, client-side SSL verification, and support for various HTTP methods. This library is integral to many applications, making it crucial to maintain its security integrity. The recent vulnerabilities identified in this package could potentially expose applications to significant security risks.
Vulnerability Detail
The vulnerabilities CVE-2026-97687 and CVE-2026-97689 in python3.14-urllib3 stem from improper handling of certain HTTP requests, which could lead to denial of service or other security breaches. Attackers could exploit these vulnerabilities to disrupt service availability or manipulate data, posing a serious threat to applications relying on this library. The vulnerabilities have been assigned a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
0:2.6.3-2.el10_2.6
This is the first release that contains the fix.
sudo dnf update python3.14-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing network-level controls to restrict access to vulnerable endpoints until the package can be updated. This may involve configuring firewalls or access control lists to limit exposure.
Conclusion
The vulnerabilities in python3.14-urllib3 pose significant risks to applications using this library. It is crucial to update to the patched version to mitigate these risks. For those unable to update immediately, implementing workarounds can help protect against potential exploits.
See every vulnerability recorded for python3.14-urllib3 →
FAQ
These are identifiers for specific vulnerabilities found in the python3.14-urllib3 package, which could lead to denial of service or data manipulation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
The CVSS score for these vulnerabilities is 7.5, indicating a high level of severity.
Implement network-level controls to restrict access to vulnerable endpoints until you can perform the update.
Detailed information can be found in the Red Hat Security Advisory and on the official CVE pages for CVE-2026-97687 and CVE-2026-97689.
Related vulnerabilities
Recent vulnerabilities recorded for python3.14-urllib3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
