Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3397-1

Опубликовано: 28 июл. 2026
Источник: suse-cvrf

Описание

Security update for python-urllib3

This update for python-urllib3 fixes the following issue

  • CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service (bsc#1268683).

Список пакетов

SUSE Linux Enterprise Module for Public Cloud 15 SP4
python311-urllib3-2.0.7-150400.7.33.1
SUSE Linux Enterprise Module for Python 3 15 SP7
python311-urllib3-2.0.7-150400.7.33.1

Ссылки

Описание

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.

Затронутые продукты
SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-urllib3-2.0.7-150400.7.33.1
SUSE Linux Enterprise Module for Python 3 15 SP7:python311-urllib3-2.0.7-150400.7.33.1
Ссылки