Multiple security vulnerabilities have been identified in urllib3, an HTTP library used for thread-safe connection pooling. The reported flaws involve certificate validation, decoding of compressed responses, and memory handling, and they can allow an attacker to observe or modify forwarded traffic or cause a denial of service. The issues affect multiple long-term support releases, with two of the flaws reported only for the 26.04 LTS release.
CVE-2026-97687: urllib3 did not correctly handle certain certificate validations. An attacker could possibly exploit this to observe or modify forwarded traffic, and the issue was reported to affect only the 26.04 LTS release.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in urllib3, an HTTP library used for thread-safe connection pooling. The reported flaws involve certificate validation, decoding of compressed responses, and memory handling, and they can allow an attacker to observe or modify forwarded traffic or cause a denial of service. The issues affect multiple long-term support releases, with two of the flaws reported only for the 26.04 LTS release.
CVE-2026-97687: urllib3 did not correctly handle certain certificate validations. An attacker could possibly exploit this to observe or modify forwarded traffic, and the issue was reported to affect only the 26.04 LTS release.[emaillocker id="1283"]
CVE-2026-97688: urllib3 did not correctly handle decoding certain deflate responses. An attacker could possibly exploit this to cause a denial of service, and the issue was reported to affect only the 26.04 LTS release.
CVE-2026-97689: urllib3 did not correctly handle certain memory operations. An attacker could possibly exploit this to cause a denial of service.
These vulnerabilities collectively present a risk of traffic interception or modification and denial of service for systems that rely on the affected HTTP library. Deployments that handle untrusted network traffic or compressed responses are most at risk, and affected environments should be assessed promptly.
The following reports contain further technical details:
[/emaillocker]