# CVE-2026-97688: python-urllib3: urllib3 is an HTTP client library for Python

CVE-2026-97688 is fixed in 3 products on 1 platform, first by python3-urllib3 2.6.3-1ubuntu1.2, released September 29, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-97688
- Priority: Routine
- CVSS: 5.3 (medium)
- EPSS: 0.0029
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 29, 2026

## Description

urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | python-urllib3 Debian 14 | 2.8.0-1 | [DEBIAN-CVE-2026-97688](https://patchblox.com/security/data/fix/linux/debian-cve-2026-97688.md) | Sep 30, 2026 |
| Linux | python-urllib3 opensuse-leap 16.0 | 2.5.0-160000.8.1 | [OPENSUSE-SU-2026:22071-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22071-1.md) | Nov 7, 2026 |
| Linux | python-urllib3 sles 15.6 | 2.0.7-150400.7.36.1 | [SUSE-SU-2026:4704-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4704-1.md) | Nov 7, 2026 |
| Linux | python-urllib3 sles 15.7 | 2.0.7-150400.7.36.1 | [SUSE-SU-2026:4704-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4704-1.md) | Nov 7, 2026 |
| Linux | python-urllib3 sles 16.0 | 2.5.0-160000.8.1 | [SUSE-SU-2026:24217-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-24217-1.md) | Nov 7, 2026 |
| Linux | python-urllib3_1 sles 15.6 | 1.26.18-150600.3.14.1 | [SUSE-SU-2026:4948-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4948-1.md) | Nov 7, 2026 |
| Linux | python-urllib3_1 sles 15.7 | 1.26.18-150600.3.14.1 | [SUSE-SU-2026:4948-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4948-1.md) | Nov 7, 2026 |
| Linux | python3-urllib3 Ubuntu 26.04.1 LTS (resolute) | 2.6.3-1ubuntu1.2 | [python3-urllib3 2.6.3-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-python3-urllib3-2.6.3-1ubuntu1.2.md) | Sep 29, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.