SUSE SLED15 / SLES15 Security Update : python-urllib3 (SUSE-SU-2026:3397-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3397-1 advisory. This update for python-urllib3 fixes the following issue - CVE-2026-9375: decompression bomb bypass in the streaming AP...

SUSE-SU-2026:22863-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issue - CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service bsc1268683...

SUSE-SU-2026:22937-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issue - CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service bsc1268683...

OESA-2026-2815 python-urllib3 security update

HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more. Security Fixes: urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API preloadcontent=False when using Brotli support. The issue arises due to three independent code...

OESA-2026-2814 python-urllib3 security update

HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more. Security Fixes: urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API preloadcontent=False when using Brotli support. The issue arises due to three independent code...

CVE-2026-9375

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

DEBIAN-CVE-2026-9375

Bulletin has no description...

CVE-2026-9375

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-9375

...

CVE-2026-9375 Decompression Bomb Bypass via Negative max_length in Streaming API in urllib3

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API preloadcontent=False when using Brotli support. The issue arises due to three independent code paths in response.py that bypass the maxlength protection introduced in version 2.6.0 to mitigate CVE-2025-66471...

CVE-2026-9375

CVE-2026-9375 is disclosed by multiple advisories tied to python-urllib3. The issue is a decompression-bomb style bypass in urllib3’s streaming API with Brotli support, enabling DoS via oversized decompressed data. Public details confirm affected software (python-urllib3) and the root cause (deco...

PT-2026-51014

Name of the Vulnerable Software and Affected Versions urllib3 version 2.6.3 Brotli version 1.2.0 Description A decompression bomb bypass exists in the streaming API preload content=False when Brotli support is used. This occurs because three independent code paths in response.py bypass the max...

Fedora 44 : cpp-httplib (2026-03599f0b32)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-03599f0b32 advisory. Update to 0.38.0 rhbz2447261 - Filename sanitization for path traversal prevention Added sanitizefilename to prevent path traversal attacks via malicious...

Fedora 43 : cpp-httplib (2026-e76feaf213)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e76feaf213 advisory. Update to 0.38.0 rhbz2447261 - Filename sanitization for path traversal prevention Added sanitizefilename to prevent path traversal attacks via malicious...

openSUSE Security Update : curl (openSUSE-2018-589)

This update for curl to version 7.60.0 fixes the following issues : These security issues were fixed : - CVE-2018-1000300: Prevent heap-based buffer overflow when closing down an FTP connection with very long server command replies bsc1092094. - CVE-2018-1000301: Prevent buffer over-read that cou...

Fedora 25 : qt5-qtwebengine (2017-58cde32413)

This update updates QtWebEngine to the 5.9.0 release. QtWebEngine 5.9.0 is part of the Qt 5.9.0 release, but only the QtWebEngine component is included in this update. The update fixes the following security issues in QtWebEngine 5.8.0: CVE-2017-5006, CVE-2017-5007, CVE-2017-5008, CVE-2017-5009,...