Most recent entries from all

ALSA-2026:27929 — Important: python3.14-urllib3 security update

Affected: AlmaLinux:10: python3.14-urllib3

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432) * urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-09264

BELL-CVE-2026-44432

Affected: Alpaquita:stream: py3-pip, Alpaquita:stream: py3-urllib3, BellSoft Hardened Containers:stream: py3-pip

BREW-abi3audit-CVE-2026-44432 — urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Affected: Homebrew: abi3audit

### Impact

urllib3's [streaming API](https://urllib3.readthedocs.io/en/2.7.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.

urllib3 can perform decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API since version 2.6.0, the library decompresses only the necessary bytes, enabling partial content consumption.

However, urllib3 before version 2.7.0 could still decompress the whole response instead of the requested portion in two cases: 1. During the second `HTTPResponse.read(amt=N)` call when the response was decompressed using the official [Brotli](https://pypi.org/project/brotli/) library. 2. When `HTTPResponse.drain_conn()` was called after the response had been read and decompressed partially (compression algorithm did not matter here).

These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side.

### Affected usages

Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected when streaming compressed responses from untrusted sources in either of these cases, unless decompression is explicitly disabled:

1. A respon…

certfr-2026-avi-0698 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-0698

Withdrawn: CLEANSTART-2026-AE28044 — Security fixes in jupyterhub-k8s-hub 4.3.2-r3

Withdrawn by the publisher.

Affected: CleanStart: jupyterhub-k8s-hub

Package jupyterhub-k8s-hub version 4.3.2-r3 fixes 2 vulnerabilities: CVE-2026-44432, CVE-2026-44431

EUVD-2026-366075

fkie_cve-2026-44432

urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.

GHSA-mf9v-mfxr-j63j — urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Affected: PyPI: urllib3

### Impact

### Affected usages

1. A respon…

openSUSE-SU-2026:10798-1 — python311-urllib3-2.7.0-1.1 on GA media

python311-urllib3-2.7.0-1.1 on GA media

PYSEC-2026-142

Affected: PyPI: urllib3

RHSA-2026:15862 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers urllib3: urllib3: Denial of Service due to excessive HTTP response decompression go.opentelemetry.io/otel: go.opentelemetry.io/otel/schema/v1.0: go.opentelemetry.io/otel/schema/v1.1: OpenTelemetry-Go: Denial of Service due to file descriptor leak github.com/containerd/containerd: containerd: Arbitrary host file read via symlink following in CRI checkpoint restore github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration.

RLSA-2026:27929 — Important: python3.14-urllib3 security update

Affected: Rocky Linux:10: python3.14-urllib3

Security Fix(es):

* urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)

* urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-44432

Affected: Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:Pro:22.04:LTS: python-pip, Ubuntu:Pro:24.04:LTS: python-pip, Ubuntu:25.10: python-pip, Ubuntu:26.04:LTS: python-urllib3, Ubuntu:Pro:26.04:LTS: python-pip

WID-SEC-W-2026-1923 — Red Hat Ansible Automation Platform: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Daten zu manipulieren und einen Denial-of-Service-Zustand herbeizuführen.