{"id":"USN-8926-1","summary":"python-urllib3 vulnerabilities","details":"Yu-Fu Fu, Seth Larson and Yonatan Magier discovered that urllib3 did not\ncorrectly handle certain certificate validations. An attacker could\npossibly use this issue to observe or modify forwarded traffic. This\nissue only affected Ubuntu 26.04 LTS. (CVE-2026-97687)\n\nMartin Desrumaux discovered that urllib3 did not correctly handle\ndecoding certain deflate responses. An attacker could possibly use this\nissue to cause a denial of service. This issue only affected\nUbuntu 26.04 LTS. (CVE-2026-97688)\n\nIt was discovered that urllib3 did not correctly handle certain memory\noperations. An attacker could possibly use this issue to cause a denial\nof service. (CVE-2026-97689)","modified":"2026-10-17T13:11:53.766526136Z","published":"2026-10-14T06:23:09Z","related":["UBUNTU-CVE-2026-97687","UBUNTU-CVE-2026-97688","UBUNTU-CVE-2026-97689"],"upstream":["CVE-2026-97687","CVE-2026-97688","CVE-2026-97689","UBUNTU-CVE-2026-97687","UBUNTU-CVE-2026-97688","UBUNTU-CVE-2026-97689"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8926-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-97687"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-97688"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-97689"}],"affected":[{"package":{"name":"python-urllib3","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/python-urllib3?arch=source&distro=esm-infra%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22-1ubuntu0.18.04.2+esm5"}]}],"versions":["1.21.1-1","1.22-1","1.22-1ubuntu0.18.04.1","1.22-1ubuntu0.18.04.2","1.22-1ubuntu0.18.04.2+esm1","1.22-1ubuntu0.18.04.2+esm2","1.22-1ubuntu0.18.04.2+esm3","1.22-1ubuntu0.18.04.2+esm4"],"ecosystem_specific":{"binaries":[{"binary_name":"python-urllib3","binary_version":"1.22-1ubuntu0.18.04.2+esm5"},{"binary_name":"python3-urllib3","binary_version":"1.22-1ubuntu0.18.04.2+esm5"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:18.04:LTS","cves":[{"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-97689"}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8926-1.json"}},{"package":{"name":"python-urllib3","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/python-urllib3?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.8-2ubuntu0.4+esm6"}]}],"versions":["1.24.1-1ubuntu1","1.24.1-1ubuntu2","1.25.8-1","1.25.8-2","1.25.8-2ubuntu0.1","1.25.8-2ubuntu0.2","1.25.8-2ubuntu0.3","1.25.8-2ubuntu0.4","1.25.8-2ubuntu0.4+esm1","1.25.8-2ubuntu0.4+esm2","1.25.8-2ubuntu0.4+esm3","1.25.8-2ubuntu0.4+esm4","1.25.8-2ubuntu0.4+esm5"],"ecosystem_specific":{"binaries":[{"binary_version":"1.25.8-2ubuntu0.4+esm6","binary_name":"python3-urllib3"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8926-1.json","cves_map":{"cves":[{"severity":[{"score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","type":"CVSS_V4"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-97689"}],"ecosystem":"Ubuntu:Pro:20.04:LTS"}}},{"package":{"name":"python-urllib3","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/python-urllib3?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.5-1~exp1ubuntu0.8"}]}],"versions":["1.26.5-1~exp1","1.26.5-1~exp1ubuntu0.1","1.26.5-1~exp1ubuntu0.2","1.26.5-1~exp1ubuntu0.3","1.26.5-1~exp1ubuntu0.4","1.26.5-1~exp1ubuntu0.5","1.26.5-1~exp1ubuntu0.6","1.26.5-1~exp1ubuntu0.7"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"python3-urllib3","binary_version":"1.26.5-1~exp1ubuntu0.8"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8926-1.json","cves_map":{"ecosystem":"Ubuntu:22.04:LTS","cves":[{"id":"CVE-2026-97689","severity":[{"score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","type":"CVSS_V4"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}]}}},{"package":{"name":"python-urllib3","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/python-urllib3?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-1ubuntu0.8"}]}],"versions":["1.26.16-1","1.26.18-1","2.0.7-1","2.0.7-1ubuntu0.1","2.0.7-1ubuntu0.2","2.0.7-1ubuntu0.3","2.0.7-1ubuntu0.4","2.0.7-1ubuntu0.5","2.0.7-1ubuntu0.6","2.0.7-1ubuntu0.7"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-urllib3","binary_version":"2.0.7-1ubuntu0.8"}],"availability":"No subscription required"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:24.04:LTS","cves":[{"severity":[{"score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","type":"CVSS_V4"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-97689"}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8926-1.json"}},{"package":{"name":"python-urllib3","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/python-urllib3?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-1ubuntu1.2"}]}],"versions":["2.3.0-3","2.5.0-1","2.5.0-1ubuntu1","2.5.0-1ubuntu2","2.6.3-1ubuntu1","2.6.3-1ubuntu1.1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-urllib3","binary_version":"2.6.3-1ubuntu1.2"}],"availability":"No subscription required"},"database_specific":{"cves_map":{"cves":[{"severity":[{"score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","type":"CVSS_V4"},{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-97687"},{"id":"CVE-2026-97688","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"score":"medium","type":"Ubuntu"}]},{"severity":[{"score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","type":"CVSS_V4"},{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-97689"}],"ecosystem":"Ubuntu:26.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8926-1.json"}}],"schema_version":"1.9.0"}