UnratedFix available
python-urllib3 vulnerabilities
Type: advisorySources: OSV
Yu-Fu Fu, Seth Larson and Yonatan Magier discovered that urllib3 did not correctly handle certain certificate validations. An attacker could possibly use this issue to observe or modify forwarded traffic. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-97687) Martin Desrumaux discovered that urllib3 did not correctly handle decoding certain deflate responses. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-97688) It was discovered that urllib3 did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-97689)
- Products
- python-urllib3
- Affected versions
- 1.21.1-1, 1.22-1, 1.22-1ubuntu0.18.04.1, 1.22-1ubuntu0.18.04.2, 1.22-1ubuntu0.18.04.2+esm1, 1.22-1ubuntu0.18.04.2+esm2, 1.22-1ubuntu0.18.04.2+esm3, 1.22-1ubuntu0.18.04.2+esm4, 1.24.1-1ubuntu1, 1.24.1-1ubuntu2, 1.25.8-1, 1.25.8-2, 1.25.8-2ubuntu0.1, 1.25.8-2ubuntu0.2, 1.25.8-2ubuntu0.3, 1.25.8-2ubuntu0.4, 1.25.8-2ubuntu0.4+esm1, 1.25.8-2ubuntu0.4+esm2, 1.25.8-2ubuntu0.4+esm3, 1.25.8-2ubuntu0.4+esm4, 1.25.8-2ubuntu0.4+esm5, 1.26.16-1, 1.26.18-1, 1.26.5-1~exp1, 1.26.5-1~exp1ubuntu0.1, 1.26.5-1~exp1ubuntu0.2, 1.26.5-1~exp1ubuntu0.3, 1.26.5-1~exp1ubuntu0.4, 1.26.5-1~exp1ubuntu0.5, 1.26.5-1~exp1ubuntu0.6, 1.26.5-1~exp1ubuntu0.7, 2.0.7-1, 2.0.7-1ubuntu0.1, 2.0.7-1ubuntu0.2, 2.0.7-1ubuntu0.3, 2.0.7-1ubuntu0.4, 2.0.7-1ubuntu0.5, 2.0.7-1ubuntu0.6, 2.0.7-1ubuntu0.7, 2.3.0-3, 2.5.0-1, 2.5.0-1ubuntu1, 2.5.0-1ubuntu2, 2.6.3-1ubuntu1, 2.6.3-1ubuntu1.1
- Fixed versions
- 1.22-1ubuntu0.18.04.2+esm5, 1.25.8-2ubuntu0.4+esm6, 1.26.5-1~exp1ubuntu0.8, 2.0.7-1ubuntu0.8, 2.6.3-1ubuntu1.2
- CVEs
- CVE-2026-97687, CVE-2026-97688, CVE-2026-97689
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 03:36 UTC · Revision 1
Source evidence
Yu-Fu Fu, Seth Larson and Yonatan Magier discovered that urllib3 did not correctly handle certain certificate validations. An attacker could possibly use this issue to observe or modify forwarded traffic. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-97687) Martin Desrumaux discovered that urllib3 did not correctly handle decoding certain deflate responses. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-97688) It was discovered that urllib3 did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-97689)
osv:USN-8926-1
python-urllib3
Fixed versions: 1.22-1ubuntu0.18.04.2+esm5
python-urllib3
Fixed versions: 1.25.8-2ubuntu0.4+esm6
python-urllib3
Fixed versions: 1.26.5-1~exp1ubuntu0.8
python-urllib3
Fixed versions: 2.0.7-1ubuntu0.8
python-urllib3
Fixed versions: 2.6.3-1ubuntu1.2
Complete source record
{
"id": "3f24a13883d2d0a9882bedf0ab7edf356c650af7f81d9af5cda194f9d70e0115",
"url": "https://osv.dev/vulnerability/USN-8926-1",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "python-urllib3 vulnerabilities",
"summary": "Yu-Fu Fu, Seth Larson and Yonatan Magier discovered that urllib3 did not correctly handle certain certificate validations. An attacker could possibly use this issue to observe or modify forwarded traffic. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-97687) Martin Desrumaux discovered that urllib3 did not correctly handle decoding certain deflate responses. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-97688) It was discovered that urllib3 did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-97689)",
"evidence": "osv:USN-8926-1",
"products": [
{
"name": {
"value": "python-urllib3",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.22-1ubuntu0.18.04.2+esm5",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "1.21.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.22-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.22-1ubuntu0.18.04.1",
"evidence": "/affected/0/versions"
},
{
"value": "1.22-1ubuntu0.18.04.2",
"evidence": "/affected/0/versions"
},
{
"value": "1.22-1ubuntu0.18.04.2+esm1",
"evidence": "/affected/0/versions"
},
{
"value": "1.22-1ubuntu0.18.04.2+esm2",
"evidence": "/affected/0/versions"
},
{
"value": "1.22-1ubuntu0.18.04.2+esm3",
"evidence": "/affected/0/versions"
},
{
"value": "1.22-1ubuntu0.18.04.2+esm4",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "python-urllib3",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.25.8-2ubuntu0.4+esm6",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "1.24.1-1ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "1.24.1-1ubuntu2",
"evidence": "/affected/1/versions"
},
{
"value": "1.25.8-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.25.8-2",
"evidence": "/affected/1/versions"
},
{
"value": "1.25.8-2ubuntu0.1",
"evidence": "/affected/1/versions"
},
{
"value": "1.25.8-2ubuntu0.2",
"evidence": "/affected/1/versions"
},
{
"value": "1.25.8-2ubuntu0.3",
"evidence": "/affected/1/versions"
},
{
"value": "1.25.8-2ubuntu0.4",
"evidence": "/affected/1/versions"
},
{
"value": "1.25.8-2ubuntu0.4+esm1",
"evidence": "/affected/1/versions"
},
{
"value": "1.25.8-2ubuntu0.4+esm2",
"evidence": "/affected/1/versions"
},
{
"value": "1.25.8-2ubuntu0.4+esm3",
"evidence": "/affected/1/versions"
},
{
"value": "1.25.8-2ubuntu0.4+esm4",
"evidence": "/affected/1/versions"
},
{
"value": "1.25.8-2ubuntu0.4+esm5",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "python-urllib3",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.26.5-1~exp1ubuntu0.8",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "1.26.5-1~exp1",
"evidence": "/affected/2/versions"
},
{
"value": "1.26.5-1~exp1ubuntu0.1",
"evidence": "/affected/2/versions"
},
{
"value": "1.26.5-1~exp1ubuntu0.2",
"evidence": "/affected/2/versions"
},
{
"value": "1.26.5-1~exp1ubuntu0.3",
"evidence": "/affected/2/versions"
},
{
"value": "1.26.5-1~exp1ubuntu0.4",
"evidence": "/affected/2/versions"
},
{
"value": "1.26.5-1~exp1ubuntu0.5",
"evidence": "/affected/2/versions"
},
{
"value": "1.26.5-1~exp1ubuntu0.6",
"evidence": "/affected/2/versions"
},
{
"value": "1.26.5-1~exp1ubuntu0.7",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "python-urllib3",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.7-1ubuntu0.8",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "1.26.16-1",
"evidence": "/affected/3/versions"
},
{
"value": "1.26.18-1",
"evidence": "/affected/3/versions"
},
{
"value": "2.0.7-1",
"evidence": "/affected/3/versions"
},
{
"value": "2.0.7-1ubuntu0.1",
"evidence": "/affected/3/versions"
},
{
"value": "2.0.7-1ubuntu0.2",
"evidence": "/affected/3/versions"
},
{
"value": "2.0.7-1ubuntu0.3",
"evidence": "/affected/3/versions"
},
{
"value": "2.0.7-1ubuntu0.4",
"evidence": "/affected/3/versions"
},
{
"value": "2.0.7-1ubuntu0.5",
"evidence": "/affected/3/versions"
},
{
"value": "2.0.7-1ubuntu0.6",
"evidence": "/affected/3/versions"
},
{
"value": "2.0.7-1ubuntu0.7",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "python-urllib3",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6.3-1ubuntu1.2",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": [
{
"value": "2.3.0-3",
"evidence": "/affected/4/versions"
},
{
"value": "2.5.0-1",
"evidence": "/affected/4/versions"
},
{
"value": "2.5.0-1ubuntu1",
"evidence": "/affected/4/versions"
},
{
"value": "2.5.0-1ubuntu2",
"evidence": "/affected/4/versions"
},
{
"value": "2.6.3-1ubuntu1",
"evidence": "/affected/4/versions"
},
{
"value": "2.6.3-1ubuntu1.1",
"evidence": "/affected/4/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "USN-8926-1",
"aliases": [
"USN-8926-1"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.22-1ubuntu0.18.04.2+esm5"
}
]
}
],
"package": {
"name": "python-urllib3",
"purl": "pkg:deb/ubuntu/python-urllib3?arch=source&distro=esm-infra%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"1.21.1-1",
"1.22-1",
"1.22-1ubuntu0.18.04.1",
"1.22-1ubuntu0.18.04.2",
"1.22-1ubuntu0.18.04.2+esm1",
"1.22-1ubuntu0.18.04.2+esm2",
"1.22-1ubuntu0.18.04.2+esm3",
"1.22-1ubuntu0.18.04.2+esm4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8926-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-97689",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:Pro:18.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-urllib3",
"binary_version": "1.22-1ubuntu0.18.04.2+esm5"
},
{
"binary_name": "python3-urllib3",
"binary_version": "1.22-1ubuntu0.18.04.2+esm5"
}
],
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.8-2ubuntu0.4+esm6"
}
]
}
],
"package": {
"name": "python-urllib3",
"purl": "pkg:deb/ubuntu/python-urllib3?arch=source&distro=esm-infra%2Ffocal",
"ecosystem": "Ubuntu:Pro:20.04:LTS"
},
"versions": [
"1.24.1-1ubuntu1",
"1.24.1-1ubuntu2",
"1.25.8-1",
"1.25.8-2",
"1.25.8-2ubuntu0.1",
"1.25.8-2ubuntu0.2",
"1.25.8-2ubuntu0.3",
"1.25.8-2ubuntu0.4",
"1.25.8-2ubuntu0.4+esm1",
"1.25.8-2ubuntu0.4+esm2",
"1.25.8-2ubuntu0.4+esm3",
"1.25.8-2ubuntu0.4+esm4",
"1.25.8-2ubuntu0.4+esm5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8926-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-97689",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:Pro:20.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-urllib3",
"binary_version": "1.25.8-2ubuntu0.4+esm6"
}
],
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.5-1~exp1ubuntu0.8"
}
]
}
],
"package": {
"name": "python-urllib3",
"purl": "pkg:deb/ubuntu/python-urllib3?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.26.5-1~exp1",
"1.26.5-1~exp1ubuntu0.1",
"1.26.5-1~exp1ubuntu0.2",
"1.26.5-1~exp1ubuntu0.3",
"1.26.5-1~exp1ubuntu0.4",
"1.26.5-1~exp1ubuntu0.5",
"1.26.5-1~exp1ubuntu0.6",
"1.26.5-1~exp1ubuntu0.7"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8926-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-97689",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:22.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-urllib3",
"binary_version": "1.26.5-1~exp1ubuntu0.8"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.7-1ubuntu0.8"
}
]
}
],
"package": {
"name": "python-urllib3",
"purl": "pkg:deb/ubuntu/python-urllib3?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.26.16-1",
"1.26.18-1",
"2.0.7-1",
"2.0.7-1ubuntu0.1",
"2.0.7-1ubuntu0.2",
"2.0.7-1ubuntu0.3",
"2.0.7-1ubuntu0.4",
"2.0.7-1ubuntu0.5",
"2.0.7-1ubuntu0.6",
"2.0.7-1ubuntu0.7"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8926-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-97689",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:24.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-urllib3",
"binary_version": "2.0.7-1ubuntu0.8"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.3-1ubuntu1.2"
}
]
}
],
"package": {
"name": "python-urllib3",
"purl": "pkg:deb/ubuntu/python-urllib3?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"2.3.0-3",
"2.5.0-1",
"2.5.0-1ubuntu1",
"2.5.0-1ubuntu2",
"2.6.3-1ubuntu1",
"2.6.3-1ubuntu1.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8926-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-97687",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-97688",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-97689",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:26.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-urllib3",
"binary_version": "2.6.3-1ubuntu1.2"
}
],
"availability": "No subscription required"
}
}
],
"modified": "2026-10-17T13:11:53.766526136Z",
"provider": "osv",
"upstream": [
"CVE-2026-97687",
"CVE-2026-97688",
"CVE-2026-97689",
"UBUNTU-CVE-2026-97687",
"UBUNTU-CVE-2026-97688",
"UBUNTU-CVE-2026-97689"
],
"references": [
"https://ubuntu.com/security/notices/USN-8926-1",
"https://ubuntu.com/security/CVE-2026-97687",
"https://ubuntu.com/security/CVE-2026-97688",
"https://ubuntu.com/security/CVE-2026-97689"
]
},
"related_cves": [
{
"value": "CVE-2026-97687",
"evidence": "/upstream"
},
{
"value": "CVE-2026-97688",
"evidence": "/upstream"
},
{
"value": "CVE-2026-97689",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 361840,
"published_at": "2026-10-14T06:23:09+00:00"
}