Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

urllib3 package can let attackers run malicious code

CVE-2026-21441 · published 1 day ago
Summary

The urllib3 library used by several Python package managers has a security hole that could let a bad actor execute unwanted code on your system. This affects Python packages from vendors such as andrey petrov, Canonical, and BellSoft. Update to the latest patched versions of urllib3 as soon as possible to close the gap.

What to do
  • Update andrey petrov urllib3 to version 2.6.3.
  • Update canonical python-urllib3 to version 2.3.0-3ubuntu0.2.
  • Update bellsoft py3-pip to version 25.1.1-r2.
  • Update canonical rootio-python3-pip to version 22.0.2+dfsg-1ubuntu0.7.root.io.7.
  • Update canonical rootio-python3-pip to version 22.0.2+dfsg-1ubuntu0.7.root.io.4.
  • Update rootio-urllib3 to version 1.25.5+root.io.2.
  • Update rootio-urllib3 to version 1.26.1+root.io.1.
  • Update rootio-urllib3 to version 2.4.0+root.io.5.
  • Update rootio-urllib3 to version 1.26.3+root.io.2.
  • Update rootio-urllib3 to version 2.0.3+root.io.2.
  • Update rootio-urllib3 to version 1.26.2+root.io.3.
  • Update rootio-urllib3 to version 1.26.0+root.io.3.
  • Update rootio-urllib3 to version 1.25.6+root.io.5.
  • Update rootio-urllib3 to version 2.0.2+root.io.3.
  • Update rootio-urllib3 to version 1.26.11+root.io.3.
  • Update rootio-urllib3 to version 1.25.5+root.io.5.
  • Update rootio-urllib3 to version 1.26.14+root.io.4.
  • Update rootio-urllib3 to version 1.25.8+root.io.4.
  • Update rootio-urllib3 to version 1.26.2+root.io.5.
  • Update rootio-urllib3 to version 2.6.1+root.io.2.
  • Update rootio-urllib3 to version 2.2.2+root.io.3.
  • Update rootio-urllib3 to version 1.26.14+root.io.6.
  • Update rootio-urllib3 to version 1.26.5+root.io.8.
  • Update rootio-urllib3 to version 2.2.3+root.io.4.
  • Update canonical python-urllib3 to version 1.25.8-2ubuntu0.4+esm3.
  • Update canonical python-urllib3 to version 1.26.5-1~exp1ubuntu0.5.
  • Update canonical python-urllib3 to version 2.0.7-1ubuntu0.4.
  • Update bellsoft py3-pip to version 22.3.1-r5.
  • Update bellsoft py3-urllib3 to version 1.26.18-r2.
  • Update bellsoft py3-urllib3 to version 1.26.20-r2.
  • Update bellsoft py3-urllib3 to version 2.6.3-r0.
  • Update urllib3 to version 1.26.15+aikido.5.
  • Update debian python-urllib3 to version 1.26.5-1~exp1+deb11u3.
  • Update debian python-urllib3 to version 1.26.12-1+deb12u3.
  • Update debian python-urllib3 to version 2.3.0-3+deb13u1.
  • Update debian python-urllib3 to version 2.5.0-2.
  • Update debian rootio-python-urllib3 to version 1.26.12-1+deb12u1.root.io.2.
  • Update canonical rootio-python3-pip to version 22.0.2+dfsg-1ubuntu0.7.aikido.9.
  • Update canonical rootio-python3-pip to version 22.0.2+dfsg-1ubuntu0.7.root.io.8.
  • Update canonical rootio-python3-pip to version 22.0.2+dfsg-1ubuntu0.7.root.io.6.
  • Update canonical python3-pip to version 22.0.2+dfsg-1ubuntu0.7.root.io.6.
  • Update urllib3 to version 1.26.12+aikido.5.
  • Update urllib3 to version 2.6.2+aikido.3.
  • Update python-pip to version 22.0.2+dfsg-1ubuntu0.7.root.io.2.
  • Update rootio-python-pip to version 22.0.2+dfsg-1ubuntu0.7.root.io.2.
  • Update urllib3 to version 1.26.19+aikido.6.
  • Update urllib3 to version 1.26.12+aikido.6.
  • Update urllib3 to version 2.6.2+aikido.4.
  • Update urllib3 to version 1.26.14+aikido.10.
  • Update urllib3 to version 1.26.7+aikido.7.
  • Update urllib3 to version 1.26.15+aikido.7.
  • Update urllib3 to version 1.26.16+aikido.9.
  • Update urllib3 to version 2.5.0+aikido.7.
  • Update urllib3 to version 2.5.0+aikido.8.
  • Update urllib3 to version 1.26.9+aikido.10.
  • Update urllib3 to version 2.4.0+aikido.8.
  • Update python urllib3 to version 2.6.3 or later.
Affected software
Ecosystem VendorProductAffected versions
pip andrey petrov urllib3 >= 1.22, < 2.6.3
Fix: upgrade to 2.6.3
Ubuntu:25.10 canonical python-pip All versions
Ubuntu:25.10 canonical python-urllib3 < 2.3.0-3ubuntu0.2
Fix: upgrade to 2.3.0-3ubuntu0.2
Ubuntu:Pro:26.04:LTS canonical python-pip All versions
BellSoft Hardened Containers:25 bellsoft py3-pip >= 25.1.1-r0, < 25.1.1-r2
Fix: upgrade to 25.1.1-r2
Root:Ubuntu:22.04 canonical rootio-python3-pip < 22.0.2+dfsg-1ubuntu0.7.root.io.7
< 22.0.2+dfsg-1ubuntu0.7.root.io.4
< 22.0.2+dfsg-1ubuntu0.7.aikido.9
< 22.0.2+dfsg-1ubuntu0.7.root.io.8
< 22.0.2+dfsg-1ubuntu0.7.root.io.6
Fix: upgrade to 22.0.2+dfsg-1ubuntu0.7.root.io.7
– python urllib3 >= 1.22, < 2.6.3
cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*
Root:PyPI – rootio-urllib3 < 1.25.5+root.io.2
< 1.26.1+root.io.1
< 2.4.0+root.io.5
< 1.26.3+root.io.2
< 2.0.3+root.io.2
< 1.26.2+root.io.3
< 1.26.0+root.io.3
< 1.25.6+root.io.5
< 2.0.2+root.io.3
< 1.26.11+root.io.3
< 1.25.5+root.io.5
< 1.26.14+root.io.4
7 more version ranges
Fix: upgrade to 1.25.5+root.io.2
Ubuntu:Pro:18.04:LTS canonical python-urllib3 All versions
Ubuntu:Pro:18.04:LTS canonical python-pip All versions
Ubuntu:Pro:20.04:LTS canonical python-urllib3 < 1.25.8-2ubuntu0.4+esm3
Fix: upgrade to 1.25.8-2ubuntu0.4+esm3
Ubuntu:22.04:LTS canonical python-urllib3 < 1.26.5-1~exp1ubuntu0.5
Fix: upgrade to 1.26.5-1~exp1ubuntu0.5
Ubuntu:Pro:22.04:LTS canonical python-pip All versions
Ubuntu:24.04:LTS canonical python-urllib3 < 2.0.7-1ubuntu0.4
Fix: upgrade to 2.0.7-1ubuntu0.4
Ubuntu:Pro:24.04:LTS canonical python-pip All versions
Alpaquita:23 bellsoft py3-pip >= 22.3.1-r2, < 22.3.1-r5
Fix: upgrade to 22.3.1-r5
Alpaquita:23 bellsoft py3-urllib3 >= 1.26.12-r1, < 1.26.18-r2
Fix: upgrade to 1.26.18-r2
Alpaquita:25 bellsoft py3-pip >= 25.1.1-r0, < 25.1.1-r2
Fix: upgrade to 25.1.1-r2
Alpaquita:25 bellsoft py3-urllib3 >= 1.26.20-r0, < 1.26.20-r2
Fix: upgrade to 1.26.20-r2
Alpaquita:stream bellsoft py3-urllib3 >= 1.26.12-r1, < 2.6.3-r0
Fix: upgrade to 2.6.3-r0
Root:PyPI – urllib3 < 1.26.15+aikido.5
< 1.26.12+aikido.5
< 2.6.2+aikido.3
< 1.26.19+aikido.6
< 1.26.12+aikido.6
< 2.6.2+aikido.4
< 1.26.14+aikido.10
< 1.26.7+aikido.7
< 1.26.15+aikido.7
< 1.26.16+aikido.9
< 2.5.0+aikido.7
< 2.5.0+aikido.8
2 more version ranges
Fix: upgrade to 1.26.15+aikido.5
– urllib3 urllib3 >= 1.22, < 2.6.3
Debian:11 debian python-urllib3 < 1.26.5-1~exp1+deb11u3
Fix: upgrade to 1.26.5-1~exp1+deb11u3
Debian:12 debian python-urllib3 < 1.26.12-1+deb12u3
Fix: upgrade to 1.26.12-1+deb12u3
Debian:13 debian python-urllib3 < 2.3.0-3+deb13u1
Fix: upgrade to 2.3.0-3+deb13u1
Debian:14 debian python-urllib3 < 2.5.0-2
Fix: upgrade to 2.5.0-2
BellSoft Hardened Containers:23 bellsoft py3-pip >= 22.3.1-r2, < 22.3.1-r5
Fix: upgrade to 22.3.1-r5
Root:Debian:12 debian rootio-python-urllib3 < 1.26.12-1+deb12u1.root.io.2
Fix: upgrade to 1.26.12-1+deb12u1.root.io.2
Root:Ubuntu:22.04 canonical python3-pip < 22.0.2+dfsg-1ubuntu0.7.root.io.6
Fix: upgrade to 22.0.2+dfsg-1ubuntu0.7.root.io.6
Root:Ubuntu:22.04 – python-pip < 22.0.2+dfsg-1ubuntu0.7.root.io.2
Fix: upgrade to 22.0.2+dfsg-1ubuntu0.7.root.io.2
Root:Ubuntu:22.04 – rootio-python-pip < 22.0.2+dfsg-1ubuntu0.7.root.io.2
Fix: upgrade to 22.0.2+dfsg-1ubuntu0.7.root.io.2
Original advisory text
CVE-2026-21441 in urllib3 - Patched by Root
Root has patched CVE-2026-21441 in the urllib3 package for Root:PyPI. Multiple fixed versions available.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.3 High
Exploitation
3% chance of attack within 30 days
Type
CWE-409Improper Handling of Highly Compressed Data (Data Amplification)
Timeline
Published3 Nov 2026
Updated3 Nov 2026
First seen6 Mar 2026
Sources
ROOT-OS-UBUNTU-2204-CVE-2026-21441 · OSV
ROOT-APP-PYPI-CVE-2026-21441 · OSV
UBUNTU-CVE-2026-21441 · OSV
BELL-CVE-2026-21441 · OSV
GHSA-38jv-5279-wg99 · GHSA
CVE-2026-21441 · NVD
CVE-2026-21441 · OSV
CVE-2026-21441 · MITRE
DEBIAN-CVE-2026-21441 · OSV
ROOT-OS-DEBIAN-12-CVE-2026-21441 · OSV
Track software like this
Free during beta