USN-8926-1: urllib3 vulnerabilities
Ubuntu fixes three urllib3 flaws, including certificate validation bypass and denial-of-service bugs.
Ubuntu USN-8926-1 covers three urllib3 vulnerabilities. CVE-2026-97687 is incorrect certificate validation that could let an attacker observe or modify forwarded traffic and affects only Ubuntu 26.04 LTS. CVE-2026-97688 is improper decoding of certain deflate responses that could cause denial of service, also limited to Ubuntu 26.04 LTS, while CVE-2026-97689 is a memory-handling denial of service. No exploitation is reported.
- CVE-2026-97687 may let attackers observe or modify forwarded traffic.
- Two other flaws can cause denial of service via deflate handling or memory operations.
- The certificate and deflate issues affect only Ubuntu 26.04 LTS.
- Ubuntu does not report active exploitation.
Vulnerabilities mentionedAll →
- CVE-2026-976898.9—Unbounded Memory Allocation in Python urllib3 Chunked-Response Parsingpublished · urllib3 project (Python) urllib3+2 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
CVE-2026-97689+2 related CVEs | Unbounded Memory Allocation in Python urllib3 Chunked-Response Parsing urllib3, the widely used Python HTTP client library, fails to bound how much data it buffers while parsing a chunked HTTP response: in versions from 1.10.3 up to (but not including) 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods read the chunk-size line until a newline or EOF with no length limit. A malicious or compromised HTTP server triggers the flaw by replying with 'Transfer-Encoding: chunked' followed by an extremely long run of bytes containing no newline, causing the client to allocate unbounded memory and eventually exhaust the process. Any application built on an affected urllib3 that makes requests to servers it does not fully control, including apps that fetch user-supplied or third-party URLs, is at risk of denial of service; the CVSS 4.0 score is 8.9 (high), reflecting a network attack vector with high availability impact but requiring the attacker to operate a hostile server. The flaw is fixed in urllib3 2.8.0. As of this writing there is no known public PoC, and it does not appear in the CISA KEV catalog. |
Yu-Fu Fu, Seth Larson and Yonatan Magier discovered that urllib3 did not correctly handle certain certificate validations. An attacker could possibly use this issue to observe or modify forwarded traffic. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-97687) Martin Desrumaux discovered that urllib3 did not correctly handle decoding certain deflate responses. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-97688) It was discovered that urllib3 did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-97689)
This source does not provide full text. Read it at ubuntu.com.