--- id: CVE-2026-97689 title: urllib3 is an HTTP client library for Python summary: >- urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newl… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-770 vendor: python product: urllib3 affected: - 'urllib3 >= 1.10.3, < 2.8.0' patched: - urllib3 2.8.0 published: '2026-09-29' updated: '2026-10-13' sourceUpdated: '2026-10-13T20:20:06.950' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97689' references: - url: >- https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed label: security-advisories@github.com - url: 'https://github.com/urllib3/urllib3/releases/tag/2.8.0' label: security-advisories@github.com - url: 'https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw' label: security-advisories@github.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97689.json - url: 'https://access.redhat.com/security/cve/CVE-2026-97689' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2543245' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-97689' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97689' - url: 'https://github.com/advisories/GHSA-vxq7-64xx-v4gw' - url: 'https://github.com/urllib3/urllib3' - url: 'https://pypi.org/project/urllib3' - url: 'https://access.redhat.com/errata/RHSA-2026:69612' - url: 'https://access.redhat.com/errata/RHSA-2026:82415' - url: 'https://access.redhat.com/errata/RHSA-2026:82368' - url: 'https://access.redhat.com/errata/RHSA-2026:82061' - url: 'https://access.redhat.com/errata/RHSA-2026:82059' - url: 'https://access.redhat.com/errata/RHSA-2026:82371' - url: 'https://access.redhat.com/errata/RHSA-2026:83116' - url: 'https://access.redhat.com/errata/RHSA-2026:83112' - url: 'https://access.redhat.com/errata/RHSA-2026:83120' - url: 'https://access.redhat.com/errata/RHSA-2026:83121' - url: 'https://access.redhat.com/errata/RHSA-2026:83114' - url: 'https://access.redhat.com/errata/RHSA-2026:84578' - url: 'https://access.redhat.com/errata/RHSA-2026:84577' tags: - nvd - cve.org - csaf - vex - red-hat - ghsa - pip - osv epss: 0.00335 epssPercentile: 0.26673 aliases: - GHSA-vxq7-64xx-v4gw - PYSEC-2026-4177 ecosystem: pip ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-09-29T16:21:49.840583Z' scores: nvd: 7.5 cna: 8.9 vendor: 7.5 ingestedAt: '2026-09-29T16:39:33.273Z' --- ## Overview urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0. ## Affected - `urllib3 >= 1.10.3, < 2.8.0` ## Remediation Upgrade past the affected range: - `urllib3 2.8.0` ## Package advisory (CVE-2026-97689) Affected packages: - `urllib3 >= 1.10.3, < 2.8.0` Patched in: - `urllib3 2.8.0` Source: https://github.com/advisories/GHSA-vxq7-64xx-v4gw ## Vendor advisories - **Red Hat VEX** · Important · affected: Ansible Automation Orchestrator 2026, Lightspeed Core, Migration Toolkit for Applications 8, Migration Toolkit for Containers, Migration Toolkit for Virtualization, OpenShift Lightspeed, … · no fix planned: Red Hat Ansible Automation Platform 2, Ansible Automation Orchestrator 2026, Lightspeed Core, Migration Toolkit for Applications 8, … · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97689.json) - **RHSA-2026:69612** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69612) - **RHSA-2026:82415** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82415) - **RHSA-2026:82368** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82368) - **RHSA-2026:82061** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82061) - **RHSA-2026:82059** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82059) - **RHSA-2026:82371** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82371) - **RHSA-2026:83116** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83116) - **RHSA-2026:83112** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83112) - **RHSA-2026:83120** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83120) - **RHSA-2026:83121** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83121) - **RHSA-2026:83114** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83114) - **RHSA-2026:84578** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84578) - **RHSA-2026:84577** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84577)