Security update for python-urllib3 (important)

openSUSE security update: security update for python-urllib3 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22071-1 Rating: important References: bsc1283908 bsc1283909 bsc1283910 Cross-References: CVE-2026-97687 CVE-2026-97688 CVE-2026-97689 CVSS...

SUSE SLED15 / SLES15 Security Update : python-urllib3 (SUSE-SU-2026:4704-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4704-1 advisory. - CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override bsc1283908. -...

Security update for python-urllib3

This update for python-urllib3 fixes the following issues: CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override bsc1283908. CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding bsc1283909. CVE-2026-97689: denial of service d...

SUSE-SU-2026:4704-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: - CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override bsc1283908. - CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding bsc1283909. - CVE-2026-97689: denial of...

SUSE SLES12 Security Update : python-urllib3 (SUSE-SU-2026:4649-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4649-1 advisory. - CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding bsc1283909. - CVE-2026-97689: denial of...

Security update for python-urllib3

This update for python-urllib3 fixes the following issues: CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding bsc1283909. CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser bsc1283910. Patch Instructions: To install this SUSE...

SUSE-SU-2026:4650-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: - CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding bsc1283909. - CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser bsc1283910...

Security update for python-urllib3

This update for python-urllib3 fixes the following issues: CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding bsc1283909. CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser bsc1283910. Patch Instructions: To install this SUSE...

SUSE-SU-2026:4649-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: - CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding bsc1283909. - CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser bsc1283910...

SUSE-SU-2026:24125-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: - CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override bsc1283908. - CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding bsc1283909. - CVE-2026-97689: denial of...

Fedora 43 : python-streamlink / python-urllib3 (2026-72a7879d08)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-72a7879d08 advisory. Update python-urllib3 to version 2.8.0, fixing three security issues: - The TLS configuration for HTTPS proxies could be ignored or overridden. Rated high...

PYSEC-2026-4176 urllib3: Chunked Deflate streaming can enter an infinite loop

Impact urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading content in chunks instead of loading the entire response body into memory at once. urllib3 can decompress response bodies according to the HTTP Content-Encoding header. When streaming a...

GHSA-GH4C-6FX4-QH6G urllib3: Chunked Deflate streaming can enter an infinite loop

Impact urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading content in chunks instead of loading the entire response body into memory at once. urllib3 can decompress response bodies according to the HTTP Content-Encoding header. When streaming a...

urllib3: Chunked Deflate streaming can enter an infinite loop

Impact urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading content in chunks instead of loading the entire response body into memory at once. urllib3 can decompress response bodies according to the HTTP Content-Encoding header. When streaming a...

CVE-2026-97688 urllib3: Chunked Deflate streaming can enter an infinite loop

urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.readchunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The...

CVE-2026-97688

The Python HTTP client library urllib3 versions 2.6.2 through 2.8.0 are vulnerable to an infinite loop during chunked Deflate streaming. The issue exists because the Deflate decoder retains trailing bytes as unconsumed input after reaching the end-of-stream, repeatedly decoding them without progr...

CVE-2026-97688

urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.readchunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The...

PT-2026-102667

Name of the Vulnerable Software and Affected Versions urllib3 versions 2.6.2 through 2.7.x Description An issue exists where HTTPResponse.stream and HTTPResponse.read chunked can enter an infinite loop. This occurs when a server sends a chunked Deflate response Transfer-Encoding: chunked and...

Fedora 44 : python-streamlink / python-urllib3 (2026-700dc0d93d)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-700dc0d93d advisory. Update python-urllib3 to version 2.8.0, fixing three security issues: - The TLS configuration for HTTPS proxies could be ignored or overridden. Rated high...

urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding

A flaw was found in urllib3. A malicious server can trigger a Denial of Service DoS by returning a specially crafted compressed response containing trailing bytes. When streaming the response in chunks, the decompression logic can enter an infinite loop by repeatedly processing unconsumed data...