SUSE-SU-2026:0367-2

Опубликовано: 23 июл. 2026

Источник: suse-cvrf

Описание

Security update for python-urllib3

This update for python-urllib3 fixes the following issues:

CVE-2025-66471: excessive resource consumption via decompression of highly compressed data in Streaming API (bsc#1254867).
CVE-2025-66418: resource exhaustion via unbounded number of links in the decompression chain (bsc#1254866).

Список пакетов

Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:latest

python311-urllib3-2.0.7-150400.7.27.1

Container suse/multi-linux-manager/5.1/x86_64/server:latest

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-BYOS

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-CHOST-BYOS

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-CHOST-BYOS-Aliyun

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-CHOST-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-CHOST-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-CHOST-BYOS-SAP-CCloud

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-HPC-BYOS

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-HPC-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-HPC-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-HPC-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-Hardened-BYOS

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-Hardened-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-Hardened-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-SAP

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-SAP-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-SAP-BYOS

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-SAP-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-SAP-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-SAP-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-SAP-Hardened

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-SAP-Hardened-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-SAP-Hardened-BYOS

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-SAP-Hardened-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-SAP-Hardened-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-SAPCAL

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-SAPCAL-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-SAPCAL-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-Azure-3P

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-Azure-Basic

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-Azure-Standard

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-CHOST-BYOS-Aliyun

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-CHOST-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-CHOST-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-CHOST-BYOS-GDC

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-CHOST-BYOS-SAP-CCloud

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-HPC-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-HPC-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-HPC-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-Hardened-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-Hardened-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-Micro-5-5

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-Micro-5-5-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-Micro-5-5-BYOS

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-Micro-5-5-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-Micro-5-5-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-Micro-5-5-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-SAP-Azure-3P

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-SAP-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-SAP-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-SAP-Hardened-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-SAP-Hardened-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-SAP-Hardened-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-SAPCAL-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP5-SAPCAL-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-Azure-3P

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-Azure-Basic

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-Azure-Standard

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-BYOS

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-CHOST-BYOS

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-CHOST-BYOS-Aliyun

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-CHOST-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-CHOST-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-CHOST-BYOS-GDC

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-CHOST-BYOS-SAP-CCloud

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-EC2-ECS-HVM

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-HPC

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-HPC-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-HPC-BYOS

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-HPC-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-HPC-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-HPC-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-Hardened-BYOS

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-Hardened-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-Hardened-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-SAP

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-SAP-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-SAP-Azure-3P

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-SAP-BYOS

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-SAP-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-SAP-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-SAP-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-SAP-Hardened

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-SAP-Hardened-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-SAP-Hardened-BYOS

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-SAP-Hardened-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-SAP-Hardened-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-SAP-Hardened-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-SAPCAL

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-SAPCAL-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP6-SAPCAL-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-Azure-3P

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-Azure-Basic

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-Azure-Standard

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-BYOS-GCE

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-CHOST-BYOS-Aliyun

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-CHOST-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-CHOST-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-CHOST-BYOS-GDC

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-CHOST-BYOS-SAP-CCloud

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-EC2-ECS-HVM

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-GCE

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-HPC-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-HPC-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-HPC-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-HPC-BYOS-GCE

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-Hardened-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-Hardened-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-Hardened-BYOS-GCE

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-SAP-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-SAP-Azure-3P

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-SAP-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-SAP-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-SAP-BYOS-GCE

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-SAP-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-SAP-GCE

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-SAP-Hardened-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-SAP-Hardened-BYOS-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-SAP-Hardened-BYOS-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-SAP-Hardened-BYOS-GCE

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-SAP-Hardened-GCE

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-SAPCAL-Azure

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-SAPCAL-EC2

python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP7-SAPCAL-GCE

python311-urllib3-2.0.7-150400.7.27.1

Image proxy-salt-broker-image

python311-urllib3-2.0.7-150400.7.27.1

Image server-image

python311-urllib3-2.0.7-150400.7.27.1

Image server-image-sles15sp7

python311-urllib3-2.0.7-150400.7.27.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS

python311-urllib3-2.0.7-150400.7.27.1

SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS

python311-urllib3-2.0.7-150400.7.27.1

SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

python311-urllib3-2.0.7-150400.7.27.1

SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS

python311-urllib3-2.0.7-150400.7.27.1

SUSE Linux Enterprise Server 15 SP4-LTSS

python311-urllib3-2.0.7-150400.7.27.1

SUSE Linux Enterprise Server 15 SP5-LTSS

python311-urllib3-2.0.7-150400.7.27.1

SUSE Linux Enterprise Server 15 SP6-LTSS

python311-urllib3-2.0.7-150400.7.27.1

SUSE Linux Enterprise Server for SAP Applications 15 SP4

python311-urllib3-2.0.7-150400.7.27.1

SUSE Linux Enterprise Server for SAP Applications 15 SP5

python311-urllib3-2.0.7-150400.7.27.1

SUSE Linux Enterprise Server for SAP Applications 15 SP6

python311-urllib3-2.0.7-150400.7.27.1

Ссылки

https://www.suse.com/support/update/announcement/2026/suse-su-20260367-2/
Link for SUSE-SU-2026:0367-2
https://lists.suse.com/pipermail/sle-updates/2026-July/048661.html
E-Mail link for SUSE-SU-2026:0367-2
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1254866
SUSE Bug 1254866
https://bugzilla.suse.com/1254867
SUSE Bug 1254867
https://www.suse.com/security/cve/CVE-2025-66418/
SUSE CVE CVE-2025-66418 page
https://www.suse.com/security/cve/CVE-2025-66471/
SUSE CVE CVE-2025-66471 page

Описание

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

Затронутые продукты

Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:latest:python311-urllib3-2.0.7-150400.7.27.1

Container suse/multi-linux-manager/5.1/x86_64/server:latest:python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-BYOS-Azure:python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-BYOS-EC2:python311-urllib3-2.0.7-150400.7.27.1

Ссылки

https://www.suse.com/security/cve/CVE-2025-66418.html
CVE-2025-66418
https://bugzilla.suse.com/1254866
SUSE Bug 1254866
https://bugzilla.suse.com/1272161
SUSE Bug 1272161

Описание

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.

Затронутые продукты

Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:latest:python311-urllib3-2.0.7-150400.7.27.1

Container suse/multi-linux-manager/5.1/x86_64/server:latest:python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-BYOS-Azure:python311-urllib3-2.0.7-150400.7.27.1

Image SLES15-SP4-BYOS-EC2:python311-urllib3-2.0.7-150400.7.27.1

Ссылки

https://www.suse.com/security/cve/CVE-2025-66471.html
CVE-2025-66471
https://bugzilla.suse.com/1254867
SUSE Bug 1254867
https://bugzilla.suse.com/1262592
SUSE Bug 1262592
https://bugzilla.suse.com/1264973
SUSE Bug 1264973
https://bugzilla.suse.com/1268540
SUSE Bug 1268540
https://bugzilla.suse.com/1268683
SUSE Bug 1268683
https://bugzilla.suse.com/1272161
SUSE Bug 1272161