Bug 2543245 (CVE-2026-97689) - CVE-2026-97689 urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser
Summary: CVE-2026-97689 urllib3: urllib3: Denial of Service via unbounded memory alloc...
Keywords:
Status: NEW
Alias: CVE-2026-97689
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-29 15:52 UTC by OSIDB Bzimport
Modified: 2026-11-11 01:58 UTC (History)
153 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2026:92359 0 None None None 2026-10-29 11:47:15 UTC
Red Hat Product Errata RHBA-2026:92373 0 None None None 2026-10-29 13:14:03 UTC
Red Hat Product Errata RHSA-2026:84577 0 None None None 2026-10-19 01:56:39 UTC
Red Hat Product Errata RHSA-2026:84578 0 None None None 2026-10-19 01:53:28 UTC
Red Hat Product Errata RHSA-2026:85929 0 None None None 2026-10-20 12:58:37 UTC
Red Hat Product Errata RHSA-2026:85930 0 None None None 2026-10-20 12:26:15 UTC
Red Hat Product Errata RHSA-2026:90494 0 None None None 2026-10-26 21:26:44 UTC
Red Hat Product Errata RHSA-2026:90759 0 None None None 2026-10-27 07:22:29 UTC
Red Hat Product Errata RHSA-2026:92474 0 None None None 2026-10-29 16:24:17 UTC
Red Hat Product Errata RHSA-2026:95655 0 None None None 2026-11-05 19:44:48 UTC
Red Hat Product Errata RHSA-2026:95656 0 None None None 2026-11-05 19:40:31 UTC
Red Hat Product Errata RHSA-2026:95657 0 None None None 2026-11-05 19:44:29 UTC
Red Hat Product Errata RHSA-2026:98096 0 None None None 2026-11-11 01:16:02 UTC
Red Hat Product Errata RHSA-2026:98097 0 None None None 2026-11-11 01:45:03 UTC
Red Hat Product Errata RHSA-2026:98098 0 None None None 2026-11-11 01:45:32 UTC
Red Hat Product Errata RHSA-2026:98122 0 None None None 2026-11-11 01:58:57 UTC
Red Hat Product Errata RHSA-2026:98125 0 None None None 2026-11-11 01:51:56 UTC
Red Hat Product Errata RHSA-2026:98126 0 None None None 2026-11-11 01:57:47 UTC

Description OSIDB Bzimport 2026-09-29 15:52:23 UTC 
urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.
Comment 1 Jon Orris 2026-10-19 01:53:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:84578 https://access.redhat.com/errata/RHSA-2026:84578
Comment 2 Jon Orris 2026-10-19 01:56:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:84577 https://access.redhat.com/errata/RHSA-2026:84577
Comment 3 Jon Orris 2026-10-20 12:26:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:85930 https://access.redhat.com/errata/RHSA-2026:85930
Comment 4 Jon Orris 2026-10-20 12:58:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:85929 https://access.redhat.com/errata/RHSA-2026:85929
Comment 5 Jon Orris 2026-10-26 21:26:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:90494 https://access.redhat.com/errata/RHSA-2026:90494
Comment 6 Jon Orris 2026-10-27 07:22:27 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:90759 https://access.redhat.com/errata/RHSA-2026:90759
Comment 8 Jon Orris 2026-10-29 16:24:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:92474 https://access.redhat.com/errata/RHSA-2026:92474
Comment 11 Jon Orris 2026-11-05 19:40:23 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.17 for RHEL 9

Via RHSA-2026:95656 https://access.redhat.com/errata/RHSA-2026:95656
Comment 12 Jon Orris 2026-11-05 19:44:21 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.18 for RHEL 9

Via RHSA-2026:95657 https://access.redhat.com/errata/RHSA-2026:95657
Comment 13 Jon Orris 2026-11-05 19:44:40 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.16 for RHEL 8
  Red Hat Satellite 6.16 for RHEL 9

Via RHSA-2026:95655 https://access.redhat.com/errata/RHSA-2026:95655
Comment 14 errata-xmlrpc 2026-11-11 01:15:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:98096 https://access.redhat.com/errata/RHSA-2026:98096
Comment 15 errata-xmlrpc 2026-11-11 01:44:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:98097 https://access.redhat.com/errata/RHSA-2026:98097
Comment 16 errata-xmlrpc 2026-11-11 01:45:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:98098 https://access.redhat.com/errata/RHSA-2026:98098
Comment 17 errata-xmlrpc 2026-11-11 01:51:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:98125 https://access.redhat.com/errata/RHSA-2026:98125
Comment 18 errata-xmlrpc 2026-11-11 01:57:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:98126 https://access.redhat.com/errata/RHSA-2026:98126
Comment 19 errata-xmlrpc 2026-11-11 01:58:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:98122 https://access.redhat.com/errata/RHSA-2026:98122
Note You need to log in before you can comment on or make changes to this bug.