https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T20:53:39.129540+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bell-cve-2026-9375 BELL-CVE-2026-9375 2026-10-02T20:53:39.139712+00:00

Affected: Alpaquita:stream: py3-urllib3

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1032 certfr-2026-avi-1032 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-02T20:53:39.139759+00:00 certfr-2026-avi-1032 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9375 fkie_cve-2026-9375 2026-10-02T20:53:39.139779+00:00

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

 https://cve.radiocsirt.org/vuln/ghsa-mwq6-fg78-p6cq GHSA-mwq6-fg78-p6cq 2026-10-02T20:53:39.139801+00:00

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.

 https://cve.radiocsirt.org/vuln/oesa-2026-2813 OESA-2026-2813 — python-urllib3 security update 2026-10-02T20:53:39.139821+00:00

Affected: openEuler:20.03-LTS-SP4: python-urllib3

HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more. Security Fix(es):

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.(CVE-2026-9375)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21430-1 openSUSE-SU-2026:21430-1 — Security update for python-urllib3 2026-10-02T20:53:39.139849+00:00

Security update for python-urllib3

 https://cve.radiocsirt.org/vuln/rhsa-2026:53459 RHSA-2026:53459 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-02T20:53:39.139866+00:00

urllib3: urllib3: Denial of Service via decompression bomb bypass with Brotli support

 https://cve.radiocsirt.org/vuln/suse-su-2026:22863-1 SUSE-SU-2026:22863-1 — Security update for python-urllib3 2026-10-02T20:53:39.139881+00:00

Security update for python-urllib3

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-9375 UBUNTU-CVE-2026-9375 2026-10-02T20:53:39.139894+00:00

Affected: Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:14.04:LTS: python-urllib3, Ubuntu:Pro:16.04:LTS: python-urllib3, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-urllib3, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: python-urllib3, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:22.04:LTS: python-urllib3, Ubuntu:Pro:22.04:LTS: python-pip and 6 more

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.