[SECURITY] Fedora 43 Update: python-urllib3-2.6.1-1.fc43

urllib3 is a powerful, user-friendly HTTP client for Python. urllib3 brings many critical features that are missing from the Python standard libraries: =E2=80=A2 Thread safety. =E2=80=A2 Connection pooling. =E2=80=A2 Client-side SSL/TLS verification. =E2=80=A2 File uploads with multipart encoding...

SUSE CVE-2025-66418

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory...

Ubuntu: Security Advisory (USN-7927-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : urllib3 vulnerabilities (USN-7927-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7927-1 advisory. Illia Volochii discovered that urllib3 did not limit the steps in a decompression chain. An attacker could possib...

USN-7927-1: urllib3 vulnerabilities

Illia Volochii discovered that urllib3 did not limit the steps in a decompression chain. An attacker could possibly use this issue to cause urllib3 to use excessive resources, causing a denial of service. CVE-2025-66418 Rui Xi discovered that urllib3 incorrectly handled highly compressed data. An...

USN-7927-1 python-urllib3 vulnerabilities

Illia Volochii discovered that urllib3 did not limit the steps in a decompression chain. An attacker could possibly use this issue to cause urllib3 to use excessive resources, causing a denial of service. CVE-2025-66418 Rui Xi discovered that urllib3 incorrectly handled highly compressed data. An...

Fedora 43 : brotli / perl-Alien-Brotli / python-urllib3 (2025-d93200cf16)

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-d93200cf16 advisory. Update brotli to 1.2.0 and python-urllib3 to 2.6.1. In python-urllib3: - Fixed a security issue where streaming API could improperly handle highly...

EulerOS 2.0 SP13 : python-pip (EulerOS-SA-2025-2531)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected...

EulerOS 2.0 SP13 : python-pip (EulerOS-SA-2025-2510)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected...

EulerOS 2.0 SP11 : python-pip (EulerOS-SA-2025-2470)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected...

urllib3 Streaming API improperly handles highly compressed data

...

GHSA-GM62-XV2J-4W53 vulnerabilities

Vulnerabilities for packages: spamcheck, ansible-operator-fips, dask-kubernetes, jupyter-base-notebook, ggshield, kserve, pgadmin4-fips, kubeflow-jupyter-web-app, airflow-core, jwt-tool, open-webui, nvidia-nsight-compute-13.2, nvidia-nsight-compute-13.3, kubeflow-katib,...

CVE-2025-66471 vulnerabilities

Vulnerabilities for packages: spamcheck, ansible-operator-fips, dask-kubernetes, jupyter-base-notebook, ggshield, kserve, pgadmin4-fips, kubeflow-jupyter-web-app, airflow-core, jwt-tool, open-webui, nvidia-nsight-compute-13.2, nvidia-nsight-compute-13.3, kubeflow-katib,...

GHSA-2XPW-W6GG-JR37 vulnerabilities

Vulnerabilities for packages: spamcheck, ansible-operator-fips, dask-kubernetes, jupyter-base-notebook, ggshield, kserve, pgadmin4-fips, kubeflow-jupyter-web-app, airflow-core, jwt-tool, open-webui, nvidia-nsight-compute-13.2, nvidia-nsight-compute-13.3, kubeflow-katib,...

CVE-2025-66418 vulnerabilities

Vulnerabilities for packages: spamcheck, ansible-operator-fips, dask-kubernetes, jupyter-base-notebook, ggshield, kserve, pgadmin4-fips, kubeflow-jupyter-web-app, airflow-core, jwt-tool, open-webui, nvidia-nsight-compute-13.2, nvidia-nsight-compute-13.3, kubeflow-katib,...

GHSA-2XPW-W6GG-JR37 vulnerabilities

Vulnerabilities for packages: dask-kubernetes, kubeflow-katib, jwt-tool, confluent-docker-utils, pypy-3.10, jupyter-base-notebook, kubeflow-volumes-web-app, az, kubeflow-pipelines, py3-pip, semgrep, kserve, pypy-3.11, ggshield, mlflow, py3-urllib3, kubeflow-pipelines-visualization-server,...

CVE-2025-66418 vulnerabilities

Vulnerabilities for packages: dask-kubernetes, kubeflow-katib, jwt-tool, confluent-docker-utils, pypy-3.10, jupyter-base-notebook, kubeflow-volumes-web-app, az, kubeflow-pipelines, py3-pip, semgrep, kserve, pypy-3.11, ggshield, mlflow, py3-urllib3, kubeflow-pipelines-visualization-server,...

GHSA-GM62-XV2J-4W53 vulnerabilities

Vulnerabilities for packages: dask-kubernetes, kubeflow-katib, jwt-tool, confluent-docker-utils, pypy-3.10, jupyter-base-notebook, kubeflow-volumes-web-app, az, kubeflow-pipelines, py3-pip, semgrep, kserve, pypy-3.11, ggshield, mlflow, py3-urllib3, kubeflow-pipelines-visualization-server,...

Linux Distros Unpatched Vulnerability : CVE-2025-66471

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed...

Linux Distros Unpatched Vulnerability : CVE-2025-66418

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was...