Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
python-urllib3 may be hijacked or cause service crash
published 19 days ago
Summary
The python-urllib3 library used on your systems can be tricked into accepting malicious HTTPS proxy settings, allowing traffic to be intercepted, and it also contains bugs that could cause it to freeze or run out of memory. These issues could disrupt your applications or expose data. Apply the latest security update for python-urllib3 as soon as possible to fix the problems.
What to do
- Update suse python-urllib3 to version 2.0.7-150400.7.36.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | suse | python-urllib3 |
< 2.0.7-150400.7.36.1 Fix: upgrade to 2.0.7-150400.7.36.1
|
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | suse | python-urllib3 |
< 2.0.7-150400.7.36.1 Fix: upgrade to 2.0.7-150400.7.36.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | suse | python-urllib3 |
< 2.0.7-150400.7.36.1 Fix: upgrade to 2.0.7-150400.7.36.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | suse | python-urllib3 |
< 2.0.7-150400.7.36.1 Fix: upgrade to 2.0.7-150400.7.36.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | suse | python-urllib3 |
< 2.0.7-150400.7.36.1 Fix: upgrade to 2.0.7-150400.7.36.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | suse | python-urllib3 |
< 2.0.7-150400.7.36.1 Fix: upgrade to 2.0.7-150400.7.36.1
|
| SUSE:Linux Enterprise Server 15 SP4-LTSS | suse | python-urllib3 |
< 2.0.7-150400.7.36.1 Fix: upgrade to 2.0.7-150400.7.36.1
|
| SUSE:Linux Enterprise Server 15 SP5-LTSS | suse | python-urllib3 |
< 2.0.7-150400.7.36.1 Fix: upgrade to 2.0.7-150400.7.36.1
|
| SUSE:Linux Enterprise Server 15 SP6-LTSS | suse | python-urllib3 |
< 2.0.7-150400.7.36.1 Fix: upgrade to 2.0.7-150400.7.36.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | suse | python-urllib3 |
< 2.0.7-150400.7.36.1 Fix: upgrade to 2.0.7-150400.7.36.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | suse | python-urllib3 |
< 2.0.7-150400.7.36.1 Fix: upgrade to 2.0.7-150400.7.36.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | suse | python-urllib3 |
< 2.0.7-150400.7.36.1 Fix: upgrade to 2.0.7-150400.7.36.1
|
Original advisory text
Security update for python-urllib3
This update for python-urllib3 fixes the following issues:
- CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override (bsc#1283908).
- CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding (bsc#1283909).
- CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser (bsc#1283910).
- CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override (bsc#1283908).
- CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding (bsc#1283909).
- CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser (bsc#1283910).
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20264704-1/ Vendor Advisory
- https://bugzilla.suse.com/1283908 Third Party Advisory
- https://bugzilla.suse.com/1283909 Third Party Advisory
- https://bugzilla.suse.com/1283910 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-97687 URL
- https://www.suse.com/security/cve/CVE-2026-97688 URL
- https://www.suse.com/security/cve/CVE-2026-97689 URL
Timeline
Published16 Oct 2026
Updated17 Oct 2026
First seen17 Oct 2026
Sources
SUSE-SU-2026:4704-1 · OSV
Track software like this
Free during beta