Improper Certificate Validation in urllib3 - CVE-2026-97687

Vulnerability identifier: #VU150185

CSH Severity: Medium

CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-97687

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose sensitive information and modify forwarded requests and responses.

The vulnerability exists due to improper certificate validation in the HTTPS proxy TLS configuration when handling TLS connections to HTTPS proxies. A remote attacker can impersonate an HTTPS proxy using a certificate accepted under the effective proxy TLS policy to disclose sensitive information and modify forwarded requests and responses.

Exploitation requires intercepting the connection to an HTTPS proxy.

urllib3
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Public Cloud Module
Python 3 Module
openSUSE Leap
Ubuntu
openEuler
SOAR QRadar Plugin App
QRadar App SDK
python-urllib3 (Ubuntu package)
python3-urllib3 (Ubuntu package)
python-urllib3 (Red Hat package)
python3-urllib3
python-urllib3
python311-urllib3_1
python3.12-urllib3 (Red Hat package)
python311-urllib3
python3.14-urllib3 (Red Hat package)

Install security update from vendor's website.

urllib3 - update to 2.8.0
SOAR QRadar Plugin App - update to 5.7.1
python-urllib3 (Ubuntu package) - update to 1.22-1ubuntu0.18.04.2+esm5
python3-urllib3 (Ubuntu package) - addressed in versions 1.22-1ubuntu0.18.04.2+esm5, 1.25.8-2ubuntu0.4+esm6, 1.26.5-1~exp1ubuntu0.8, 2.0.7-1ubuntu0.8, 2.6.3-1ubuntu1.2
python-urllib3 (Red Hat package) - addressed in versions 1.26.5-8.el9_8.2, 1.26.19-4.el10_2.2
python3-urllib3 - addressed in versions 1.26.12-16, 1.26.18-11
python-urllib3 - addressed in versions 1.26.12-16, 1.26.18-11
python311-urllib3_1 - update to 1.26.18-150600.3.14.1
python3.12-urllib3 (Red Hat package) - addressed in versions 1.26.19-3.el9_8.2, 1.26.19-5.el8_10
python311-urllib3 - update to 2.0.7-150400.7.36.1
python3.14-urllib3 (Red Hat package) - addressed in versions 2.6.3-2.el9_8.6, 2.6.3-2.el10_2.6
QRadar App SDK - update to 2.2.8

• https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77
• https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3
• https://github.com/urllib3/urllib3/releases/tag/2.8.0

• Multiple vulnerabilities in urllib3
• Red Hat Enterprise Linux 9 update for python3.14-urllib3
• Red Hat Enterprise Linux 10 update for python3.14-urllib3
• Red Hat Enterprise Linux 9 update for python3.12-urllib3
• Red Hat Enterprise Linux 10 update for python-urllib3
• SUSE update for python-urllib3
• Multiple vulnerabilities in IBM QRadar App SDK
• Multiple vulnerabilities in IBM SOAR QRadar Plugin App
• Red Hat Enterprise Linux 9 update for python-urllib3
• openEuler 24.03 LTS SP3 update for python-urllib3
• openEuler 24.03 LTS SP1 update for python-urllib3
• openEuler 22.03 LTS SP4 update for python-urllib3
• openEuler 24.03 LTS SP4 update for python-urllib3
• Red Hat Enterprise Linux 8 update for python3.12-urllib3
• Ubuntu update for python-urllib3
• SUSE update for python-urllib3_1