{"id":"CVE-2026-97689","title":"urllib3 is an HTTP client library for Python","summary":"urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newl…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-770"],"vendor":"python","product":"urllib3","affected":["urllib3 >= 1.10.3, < 2.8.0"],"patched":["urllib3 2.8.0"],"published":"2026-09-29","updated":"2026-10-13","sourceUpdated":"2026-10-13T20:20:06.950","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97689","references":[{"url":"https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","label":"security-advisories@github.com"},{"url":"https://github.com/urllib3/urllib3/releases/tag/2.8.0","label":"security-advisories@github.com"},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97689.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-97689"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543245"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97689"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97689"},{"url":"https://github.com/advisories/GHSA-vxq7-64xx-v4gw"},{"url":"https://github.com/urllib3/urllib3"},{"url":"https://pypi.org/project/urllib3"},{"url":"https://access.redhat.com/errata/RHSA-2026:69612"},{"url":"https://access.redhat.com/errata/RHSA-2026:82415"},{"url":"https://access.redhat.com/errata/RHSA-2026:82368"},{"url":"https://access.redhat.com/errata/RHSA-2026:82061"},{"url":"https://access.redhat.com/errata/RHSA-2026:82059"},{"url":"https://access.redhat.com/errata/RHSA-2026:82371"},{"url":"https://access.redhat.com/errata/RHSA-2026:83116"},{"url":"https://access.redhat.com/errata/RHSA-2026:83112"},{"url":"https://access.redhat.com/errata/RHSA-2026:83120"},{"url":"https://access.redhat.com/errata/RHSA-2026:83121"},{"url":"https://access.redhat.com/errata/RHSA-2026:83114"},{"url":"https://access.redhat.com/errata/RHSA-2026:84578"},{"url":"https://access.redhat.com/errata/RHSA-2026:84577"}],"tags":["nvd","cve.org","csaf","vex","red-hat","ghsa","pip","osv"],"epss":0.00335,"epssPercentile":0.26673,"aliases":["GHSA-vxq7-64xx-v4gw","PYSEC-2026-4177"],"ecosystem":"pip","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-29T16:21:49.840583Z"},"scores":{"nvd":7.5,"cna":8.9,"vendor":7.5},"ingestedAt":"2026-09-29T16:39:33.273Z","slug":"CVE-2026-97689","body":"## Overview\n\nurllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.\n\n## Affected\n\n- `urllib3 >= 1.10.3, < 2.8.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `urllib3 2.8.0`\n\n## Package advisory (CVE-2026-97689)\n\nAffected packages:\n\n- `urllib3 >= 1.10.3, < 2.8.0`\n\nPatched in:\n\n- `urllib3 2.8.0`\n\nSource: https://github.com/advisories/GHSA-vxq7-64xx-v4gw\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Ansible Automation Orchestrator 2026, Lightspeed Core, Migration Toolkit for Applications 8, Migration Toolkit for Containers, Migration Toolkit for Virtualization, OpenShift Lightspeed, … · no fix planned: Red Hat Ansible Automation Platform 2, Ansible Automation Orchestrator 2026, Lightspeed Core, Migration Toolkit for Applications 8, … · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97689.json)\n- **RHSA-2026:69612** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69612)\n- **RHSA-2026:82415** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82415)\n- **RHSA-2026:82368** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82368)\n- **RHSA-2026:82061** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82061)\n- **RHSA-2026:82059** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82059)\n- **RHSA-2026:82371** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82371)\n- **RHSA-2026:83116** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83116)\n- **RHSA-2026:83112** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83112)\n- **RHSA-2026:83120** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83120)\n- **RHSA-2026:83121** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83121)\n- **RHSA-2026:83114** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83114)\n- **RHSA-2026:84578** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84578)\n- **RHSA-2026:84577** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84577)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":219883,"id":"CVE-2026-97689","ts":1791924865298,"field":"cvss","old":"8.9","new":"7.5"}]}