Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:4649-1

Опубликовано: 13 окт. 2026
Источник: suse-cvrf

Описание

Security update for python-urllib3

This update for python-urllib3 fixes the following issues:

  • CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding (bsc#1283909).
  • CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser (bsc#1283910).

Список пакетов

SUSE Linux Enterprise Module for Public Cloud 12
python-urllib3-1.25.10-3.54.1
python3-urllib3-1.25.10-3.54.1
SUSE Linux Enterprise Server 12 SP5-LTSS
python-urllib3-1.25.10-3.54.1
python3-urllib3-1.25.10-3.54.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
python-urllib3-1.25.10-3.54.1
python3-urllib3-1.25.10-3.54.1

Ссылки

Описание

urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0.

Затронутые продукты
SUSE Linux Enterprise Module for Public Cloud 12:python-urllib3-1.25.10-3.54.1
SUSE Linux Enterprise Module for Public Cloud 12:python3-urllib3-1.25.10-3.54.1
SUSE Linux Enterprise Server 12 SP5-LTSS:python-urllib3-1.25.10-3.54.1
SUSE Linux Enterprise Server 12 SP5-LTSS:python3-urllib3-1.25.10-3.54.1
Ссылки

Описание

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.

Затронутые продукты
SUSE Linux Enterprise Module for Public Cloud 12:python-urllib3-1.25.10-3.54.1
SUSE Linux Enterprise Module for Public Cloud 12:python3-urllib3-1.25.10-3.54.1
SUSE Linux Enterprise Server 12 SP5-LTSS:python-urllib3-1.25.10-3.54.1
SUSE Linux Enterprise Server 12 SP5-LTSS:python3-urllib3-1.25.10-3.54.1
Ссылки
Уязвимость SUSE-SU-2026:4649-1