Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
suse/python-urllib3_1 may allow interception or crashes
published 5 days ago
Summary
The Python urllib3 library version used by SUSE can be tricked into letting attackers watch or alter secure traffic, and it can also freeze or crash when handling certain compressed data. This could expose sensitive information or cause service downtime. Update to the latest package version to close these gaps.
What to do
- Update suse python-urllib3_1 to version 1.26.18-150600.3.14.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | suse | python-urllib3_1 |
< 1.26.18-150600.3.14.1 Fix: upgrade to 1.26.18-150600.3.14.1
|
| SUSE:Linux Enterprise Server 15 SP6-LTSS | suse | python-urllib3_1 |
< 1.26.18-150600.3.14.1 Fix: upgrade to 1.26.18-150600.3.14.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | suse | python-urllib3_1 |
< 1.26.18-150600.3.14.1 Fix: upgrade to 1.26.18-150600.3.14.1
|
Original advisory text
Security update for python-urllib3_1
This update for python-urllib3_1 fixes the following issues:
- CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override (bsc#1283908).
- CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding (bsc#1283909).
- CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser (bsc#1283910).
- CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override (bsc#1283908).
- CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding (bsc#1283909).
- CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser (bsc#1283910).
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20264948-1/ Vendor Advisory
- https://bugzilla.suse.com/1283908 Third Party Advisory
- https://bugzilla.suse.com/1283909 Third Party Advisory
- https://bugzilla.suse.com/1283910 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-97687 URL
- https://www.suse.com/security/cve/CVE-2026-97688 URL
- https://www.suse.com/security/cve/CVE-2026-97689 URL
Timeline
Published30 Oct 2026
Updated2 Nov 2026
First seen2 Nov 2026
Sources
SUSE-SU-2026:4948-1 · OSV
Track software like this
Free during beta