Red Hat Security Advisory: python-urllib3 security update
Affects Red Hat python-urllib3Source GCVE Database
Mentioned vulnerabilities
Not known to be exploited.
Data as of 2 Nov 2026, 20:28 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
Exploitation evidence
Disclosed: evidence found.
CVE published 2 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2 Nov 2026.
What to do
AI-suggested
Red Hat has released updated python-urllib3 packages for Red Hat Enterprise Linux 10 that fix these vulnerabilities. Users should apply the updates as described in Red Hat advisory RHSA-2026:85930 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated beyond applying the official patches.
Description
Two security vulnerabilities were identified in the python-urllib3 package used in Red Hat Enterprise Linux 10. One is a denial of service vulnerability caused by unbounded memory allocation in the chunk parser (CVE-2026-97689). The other allows traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687). Red Hat has released updates addressing these issues.
References
- access.redhat.com/errata/RHSA-2026:85930 (opens in a new tab)
- access.redhat.com/security/updates/classification/ (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=2543245 (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=2543255 (opens in a new tab)
- security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85930.json (opens in a new tab)