CVE-2026-97687

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

CVE-2026-97687 is fixed in 5 products on 1 platform, first by python3-urllib3 2.6.3-1ubuntu1.2, released September 29, 2026. It is not reported as exploited. Patch Radar priority: High.

High
CVSS
8.1
Important
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0021
10th percentile

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689) * urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Where it's fixed

ProductFixed inFixReleased
Linux
python-urllib3 · Debian 14 2.8.0-1 DEBIAN-CVE-2026-97687 Sep 30, 2026
python-urllib3 · RHEL 10 1.26.19-4.el10_2.2 RHSA-2026:85930 Sep 29, 2026
python-urllib3 · opensuse-leap 16.0 2.5.0-160000.8.1 OPENSUSE-SU-2026:22071-1 Nov 7, 2026
python-urllib3 · rocky 10 0:1.26.19-4.el10_2.2 RLSA-2026:85930 Nov 7, 2026
python-urllib3 · rocky 9 0:1.26.5-8.el9_8.2 RLSA-2026:90494 Nov 7, 2026
python-urllib3 · sles 15.6 2.0.7-150400.7.36.1 SUSE-SU-2026:4704-1 Nov 7, 2026
python-urllib3 · sles 15.7 2.0.7-150400.7.36.1 SUSE-SU-2026:4704-1 Nov 7, 2026
python-urllib3 · sles 16.0 2.5.0-160000.8.1 SUSE-SU-2026:24217-1 Nov 7, 2026
python-urllib3_1 · sles 15.6 1.26.18-150600.3.14.1 SUSE-SU-2026:4948-1 Nov 7, 2026
python-urllib3_1 · sles 15.7 1.26.18-150600.3.14.1 SUSE-SU-2026:4948-1 Nov 7, 2026
python3-urllib3 · RHEL 9 0:1.26.5-8.el9_8.2 RHSA-2026:90494 Oct 29, 2026
python3-urllib3 · Ubuntu 26.04.1 LTS (resolute) 2.6.3-1ubuntu1.2 python3-urllib3 2.6.3-1ubuntu1.2 Sep 29, 2026
python3-urllib3 · almalinux 10 1.26.19-4.el10_2.2 ALSA-2026:85930 Nov 7, 2026
python3-urllib3 · almalinux 9 1.26.5-8.el9_8.2 ALSA-2026:90494 Nov 7, 2026
python3-urllib3 · ol 10 0:1.26.19-4.el10_2.2 ELSA-2026-85930 Nov 7, 2026
python3-urllib3 · ol 9 0:1.26.5-8.el9_8.2 ELSA-2026-90494 Nov 7, 2026
python3.12-urllib3 · RHEL 8 0:1.26.19-5.el8_10 RHSA-2026:92474 Oct 30, 2026
python3.12-urllib3 · RHEL 9 0:1.26.19-3.el9_8.2 RHSA-2026:85929 Oct 21, 2026
python3.12-urllib3 · almalinux 8 1.26.19-5.el8_10 ALSA-2026:92474 Nov 7, 2026
python3.12-urllib3 · almalinux 9 1.26.19-3.el9_8.2 ALSA-2026:85929 Nov 7, 2026
python3.12-urllib3 · ol 8 0:1.26.19-5.el8_10 ELSA-2026-92474 Nov 7, 2026
python3.12-urllib3 · ol 9 0:1.26.19-3.el9_8.2 ELSA-2026-85929 Nov 7, 2026
python3.12-urllib3 · rocky 8 0:1.26.19-5.el8_10 RLSA-2026:92474 Nov 7, 2026
python3.12-urllib3 · rocky 9 0:1.26.19-3.el9_8.2 RLSA-2026:85929 Nov 7, 2026
python3.14-urllib3 · RHEL 10 2.6.3-2.el10_2.6 RHSA-2026:84578 Oct 19, 2026
python3.14-urllib3 · RHEL 9 0:2.6.3-2.el9_8.6 RHSA-2026:84577 Oct 19, 2026
python3.14-urllib3 · almalinux 10 2.6.3-2.el10_2.6 ALSA-2026:84578 Nov 7, 2026
python3.14-urllib3 · almalinux 9 2.6.3-2.el9_8.6 ALSA-2026:84577 Nov 7, 2026
python3.14-urllib3 · ol 10 0:2.6.3-2.el10_2.6 ELSA-2026-84578 Nov 7, 2026
python3.14-urllib3 · ol 9 0:2.6.3-2.el9_8.6 ELSA-2026-84577 Nov 7, 2026
python3.14-urllib3 · rocky 10 0:2.6.3-2.el10_2.6 RLSA-2026:84578 Nov 7, 2026
python3.14-urllib3 · rocky 9 0:2.6.3-2.el9_8.6 RLSA-2026:84577 Nov 7, 2026

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.