Two security vulnerabilities affect the python-urllib3 HTTP client library. The first (CVE-2026-97687) involves improper separation of TLS settings between the target server and an HTTPS proxy, allowing an attacker controlling the proxy to intercept or modify traffic by exploiting certificate verification bypass. The second (CVE-2026-97689) allows a malicious HTTP server to cause unbounded memory allocation by sending a very long chunk-size line without newline, potentially exhausting client memory. Both issues are fixed in version 2.8.0.