SB2026091644 - Multiple vulnerabilities in urllib3

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091644

SB2026091644 - Multiple vulnerabilities in urllib3

Published: September 16, 2026 Updated: September 18, 2026

Security Bulletin ID SB2026091644
CSH Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a loop with an unreachable exit condition in the Deflate decoder when processing a chunked Deflate-encoded response containing bytes after the end of the compressed stream. A remote attacker can send a specially crafted response to cause a denial of service.

Exploitation requires content decoding to be enabled, streaming with a positive finite chunk size, and a decoded body that exceeds the requested chunk size.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the HTTPResponse.stream() and read_chunked() methods when processing a chunked-transfer-encoded response with an unterminated chunk-size field. A remote attacker can send a crafted chunked response containing a long run of bytes without a newline to cause a denial of service.


3) Improper Certificate Validation (CVE-ID: N/A)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and modify forwarded requests and responses.

The vulnerability exists due to improper certificate validation in the HTTPS proxy TLS configuration when handling TLS connections to HTTPS proxies. A remote attacker can impersonate an HTTPS proxy using a certificate accepted under the effective proxy TLS policy to disclose sensitive information and modify forwarded requests and responses.

Exploitation requires intercepting the connection to an HTTPS proxy.


Remediation

Install update from vendor's website.

References