Infinite loop in urllib3 - CVE-2026-97688

Vulnerability identifier: #VU150183

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-97688

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a loop with an unreachable exit condition in the Deflate decoder when processing a chunked Deflate-encoded response containing bytes after the end of the compressed stream. A remote attacker can send a specially crafted response to cause a denial of service.

Exploitation requires content decoding to be enabled, streaming with a positive finite chunk size, and a decoded body that exceeds the requested chunk size.

urllib3
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Public Cloud Module
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
Python 3 Module
Basesystem Module
openSUSE Leap
Ubuntu
SOAR QRadar Plugin App
QRadar App SDK
python-urllib3 (Ubuntu package)
python3-urllib3 (Ubuntu package)
python-urllib3
python3-urllib3
python311-urllib3_1
python311-urllib3

Install security update from vendor's website.

urllib3 - update to 2.8.0
SOAR QRadar Plugin App - update to 5.7.1
python-urllib3 (Ubuntu package) - update to 1.22-1ubuntu0.18.04.2+esm5
python3-urllib3 (Ubuntu package) - addressed in versions 1.22-1ubuntu0.18.04.2+esm5, 1.25.8-2ubuntu0.4+esm6, 1.26.5-1~exp1ubuntu0.8, 2.0.7-1ubuntu0.8, 2.6.3-1ubuntu1.2
python-urllib3 - update to 1.25.10-3.54.1
python3-urllib3 - addressed in versions 1.25.10-3.54.1, 1.25.10-150300.4.33.1
python311-urllib3_1 - update to 1.26.18-150600.3.14.1
python311-urllib3 - update to 2.0.7-150400.7.36.1
QRadar App SDK - update to 2.2.8

• https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g
• https://github.com/urllib3/urllib3/releases/tag/2.8.0

• Multiple vulnerabilities in urllib3
• SUSE update for python-urllib3
• SUSE update for python-urllib3
• SUSE update for python-urllib3
• Multiple vulnerabilities in IBM QRadar App SDK
• Multiple vulnerabilities in IBM SOAR QRadar Plugin App
• Ubuntu update for python-urllib3
• SUSE update for python-urllib3_1