urllib3 2.8.0

{
  "id": "50e3b00fb6b2459750111fd544eb5cb423d8da85660555052ea1c80b2d60976e",
  "url": "https://github.com/urllib3/urllib3/releases/tag/2.8.0",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "urllib3 2.8.0",
    "summary": "urllib3 2.8.0 fixes three security issues involving HTTPS proxy TLS configuration, unbounded chunk-size buffering, and a possible infinite loop in Chunked Deflate streaming. It also adds safeguards in proxy tunneling for invalid characters.",
    "evidence": "Security Fixed the following security issues: The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77) HTTPResponse.stream() and read_chunked() could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw) Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)",
    "products": [
      {
        "name": {
          "value": "urllib3",
          "evidence": "Release notes from urllib3"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.8.0",
            "evidence": "2.8.0"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-urllib3-urllib3",
  "document_id": 22811,
  "published_at": "2026-09-15T19:40:51+00:00"
}