SB2026102674 - Red Hat Enterprise Linux 9 update for python-urllib3
Published: October 26, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-97689)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the HTTPResponse.stream() and read_chunked() methods when processing a chunked-transfer-encoded response with an unterminated chunk-size field. A remote attacker can send a crafted chunked response containing a long run of bytes without a newline to cause a denial of service.
2) Improper Certificate Validation (CVE-ID: CVE-2026-97687)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information and modify forwarded requests and responses.
The vulnerability exists due to improper certificate validation in the HTTPS proxy TLS configuration when handling TLS connections to HTTPS proxies. A remote attacker can impersonate an HTTPS proxy using a certificate accepted under the effective proxy TLS policy to disclose sensitive information and modify forwarded requests and responses.
Exploitation requires intercepting the connection to an HTTPS proxy.
Remediation
Install update from vendor's website.