Most recent entries from all

ALSA-2026:1086 — Important: python-urllib3 security update

Affected: AlmaLinux:10: python3-urllib3

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418) * urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-02927

BELL-CVE-2025-66418

Affected: Alpaquita:23: py3-pip, Alpaquita:23: py3-urllib3, Alpaquita:25: py3-pip, Alpaquita:25: py3-urllib3, Alpaquita:stream: py3-urllib3, BellSoft Hardened Containers:23: py3-pip, BellSoft Hardened Containers:25: py3-pip

BREW-abi3audit-CVE-2025-66418 — urllib3 allows an unbounded number of links in the decompression chain

Affected: Homebrew: abi3audit

## Impact

urllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).

However, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.

## Affected usages

Applications and libraries using urllib3 version 2.5.0 and earlier for HTTP requests to untrusted sources unless they disable content decoding explicitly.

## Remediation

Upgrade to at least urllib3 v2.6.0 in which the library limits the number of links to 5.

If upgrading is not immediately possible, use [`preload_content=False`](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) and ensure that `resp.headers["content-encoding"]` contains a safe number of encodings before reading the response content.

certfr-2026-avi-0109 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-0109

EUVD-2026-262665

fkie_cve-2025-66418

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

GHSA-gm62-xv2j-4w53 — urllib3 allows an unbounded number of links in the decompression chain

Affected: PyPI: urllib3

## Impact

urllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).

## Affected usages

Applications and libraries using urllib3 version 2.5.0 and earlier for HTTP requests to untrusted sources unless they disable content decoding explicitly.

## Remediation

Upgrade to at least urllib3 v2.6.0 in which the library limits the number of links to 5.

msrc_CVE-2025-66418 — urllib3 allows an unbounded number of links in the decompression chain

msrc_CVE-2025-66418

NCSC-2026-0022 — Kwetsbaarheden verholpen in Oracle Communications producten

NCSC-2026-0022

OESA-2026-1233 — python-urllib3 security update

Affected: openEuler:24.03-LTS: python-urllib3

HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more. Security Fix(es):

openSUSE-SU-2026:10026-1 — python311-urllib3-2.6.2-1.1 on GA media

python311-urllib3-2.6.2-1.1 on GA media

PYSEC-2026-1998 — urllib3 allows an unbounded number of links in the decompression chain

Affected: PyPI: urllib3

## Impact

urllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).

## Affected usages

Applications and libraries using urllib3 version 2.5.0 and earlier for HTTP requests to untrusted sources unless they disable content decoding explicitly.

## Remediation

Upgrade to at least urllib3 v2.6.0 in which the library limits the number of links to 5.

RHSA-2026:0050 — Red Hat Security Advisory: Red Hat OpenShift Builds 1.6.2

runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion

SUSE-SU-2026:1412-1 — Security update for python-urllib3

Security update for python-urllib3

UBUNTU-CVE-2025-66418

Affected: Ubuntu:Pro:20.04:LTS: python-urllib3, Ubuntu:22.04:LTS: python-urllib3, Ubuntu:Pro:22.04:LTS: python-pip, Ubuntu:24.04:LTS: python-urllib3, Ubuntu:Pro:24.04:LTS: python-pip, Ubuntu:25.10: python-pip, Ubuntu:25.10: python-urllib3, Ubuntu:26.04:LTS: python-urllib3

WID-SEC-W-2025-2927 — NetApp ActiveIQ Unified Manager: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in NetApp ActiveIQ Unified Manager ausnutzen, um einen Denial of Service Angriff durchzuführen.