Most recent entries from all

ALSA-2026:27929 — Important: python3.14-urllib3 security update

Affected: AlmaLinux:10: python3.14-urllib3

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432) * urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-09265

BELL-CVE-2026-44431

Affected: Alpaquita:23: py3-pip, Alpaquita:23: py3-urllib3, Alpaquita:25: py3-pip, Alpaquita:25: py3-urllib3, Alpaquita:stream: py3-pip, Alpaquita:stream: py3-urllib3, BellSoft Hardened Containers:23: py3-pip, BellSoft Hardened Containers:25: py3-pip, BellSoft Hardened Containers:stream: py3-pip

BREW-abi3audit-CVE-2026-44431 — urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

Affected: Homebrew: abi3audit

### Impact

When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as `urllib3.request()`, `PoolManager.request()`, and `ProxyManager.request()`, sensitive headers — `Authorization`, `Cookie`, and `Proxy-Authorization` (defined in `Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT`) — are stripped by default, as expected.

However, cross-origin redirects followed from the low-level API via `ProxyManager.connection_from_url().urlopen(..., assert_same_host=False)` still forward these sensitive headers.

### Affected usage

Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through `HTTPConnection.urlopen()` instances created via `ProxyManager.connection_from_url()`.

### Remediation

Upgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by `HTTPConnection`.

If upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to `ProxyManager.request()`.

certfr-2026-avi-0623 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un at…

certfr-2026-avi-0623

Withdrawn: CLEANSTART-2026-AE28044 — Security fixes in jupyterhub-k8s-hub 4.3.2-r3

Withdrawn by the publisher.

Affected: CleanStart: jupyterhub-k8s-hub

Package jupyterhub-k8s-hub version 4.3.2-r3 fixes 2 vulnerabilities: CVE-2026-44432, CVE-2026-44431

EUVD-2026-330522

fkie_cve-2026-44431

urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.

GHSA-qccp-gfcp-xxvc — urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

Affected: PyPI: urllib3

### Impact

However, cross-origin redirects followed from the low-level API via `ProxyManager.connection_from_url().urlopen(..., assert_same_host=False)` still forward these sensitive headers.

### Affected usage

### Remediation

Upgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by `HTTPConnection`.

If upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to `ProxyManager.request()`.

msrc_CVE-2026-44431 — urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

msrc_CVE-2026-44431

OESA-2026-2298 — python-urllib3 security update

Affected: openEuler:24.03-LTS-SP1: python-urllib3

HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more. Security Fix(es):

openSUSE-SU-2026:10838-1 — python311-urllib3_1-1.26.20-6.1 on GA media

python311-urllib3_1-1.26.20-6.1 on GA media

PYSEC-2026-141

Affected: PyPI: urllib3

RHSA-2026:24009 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers urllib3: urllib3: Denial of Service due to excessive HTTP response decompression

RLSA-2026:27929 — Important: python3.14-urllib3 security update

Affected: Rocky Linux:10: python3.14-urllib3

Security Fix(es):

* urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)

* urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:2065-1 — Security update for python-urllib3

Security update for python-urllib3

UBUNTU-CVE-2026-44431

Affected: Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:14.04:LTS: python-urllib3, Ubuntu:Pro:16.04:LTS: python-urllib3, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-urllib3, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: python-urllib3, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:22.04:LTS: python-urllib3, Ubuntu:Pro:22.04:LTS: python-pip and 6 more

WID-SEC-W-2026-1923 — Red Hat Ansible Automation Platform: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Daten zu manipulieren und einen Denial-of-Service-Zustand herbeizuführen.