urllib3 (Product): news timeline & CVEs

USN-8926-1: urllib3 vulnerabilities

Ubuntu fixes three urllib3 flaws, including certificate validation bypass and denial-of-service bugs.

Ubuntu USN-8926-1 covers three urllib3 vulnerabilities. CVE-2026-97687 is incorrect certificate validation that could let an attacker observe or modify forwarded traffic and affects only Ubuntu 26.04 LTS. CVE-2026-97688 is improper decoding of certain deflate responses that could cause denial of service, also limited to Ubuntu 26.04 LTS, while CVE-2026-97689 is a memory-handling denial of service. No exploitation is reported.

Ubuntu Security Noticesupdated Oct 14, 13:00 UTC · 2d agofirst Oct 14, 06:23 UTC · 2d agoVulnerability 3 sources CVE-2026-97687 CVE-2026-97688 CVE-2026-976891· 1 read

USN-8811-1: urllib3 vulnerability

Ubuntu fixed an urllib3 flaw that can leak sensitive HTTP headers on cross-origin redirects.

Ubuntu Security Notice USN-8811-1 says urllib3 did not correctly strip sensitive HTTP headers during cross-origin redirects. An attacker could possibly use that behavior to leak sensitive information. The notice does not report observed exploitation.

Ubuntu Security NoticesSep 24, 01:39 UTC · 23d agoAdvisory1

urllib3

Timeline2 articles

Related CVEsby mentions

Appears with

USN-8926-1: urllib3 vulnerabilities

USN-8811-1: urllib3 vulnerability