ELSA-2026-85930

ELSA-2026-85930 - python-urllib3 security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-20

Description

[1.26.19-4.2]
- CVE-2026-97689 python3.12-urllib3: urllib3: Denial of Service via
unbounded memory allocation in chunk parser
Resolves: RHEL-282258

[1.26.19-4.1]
- CVE-2026-97687 python3.12-urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override
HTTPS proxy TLS configuration override
Resolves: RHEL-282317

Related CVEs

CVE-2026-97687

CVE-2026-97689

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	python-urllib3-1.26.19-4.el10_2.2.src.rpm	543beb5d93e57f92b1154cd56fe1f2ac81d2e029d4b3c49da6458b621f3aa04b	-	ol10_aarch64_baseos_latest
	python-urllib3-1.26.19-4.el10_2.2.src.rpm	543beb5d93e57f92b1154cd56fe1f2ac81d2e029d4b3c49da6458b621f3aa04b	-	ol10_aarch64_u2_baseos_patch
	python3-urllib3-1.26.19-4.el10_2.2.noarch.rpm	04207175b8d59e5950d06e9e4a57ac737b252dfd381bfbc59930c09834356e8f	-	ol10_aarch64_baseos_latest
	python3-urllib3-1.26.19-4.el10_2.2.noarch.rpm	04207175b8d59e5950d06e9e4a57ac737b252dfd381bfbc59930c09834356e8f	-	ol10_aarch64_u2_baseos_patch
Oracle Linux 10 (x86_64)	python-urllib3-1.26.19-4.el10_2.2.src.rpm	543beb5d93e57f92b1154cd56fe1f2ac81d2e029d4b3c49da6458b621f3aa04b	-	ol10_x86_64_baseos_latest
	python-urllib3-1.26.19-4.el10_2.2.src.rpm	543beb5d93e57f92b1154cd56fe1f2ac81d2e029d4b3c49da6458b621f3aa04b	-	ol10_x86_64_u2_baseos_patch
	python3-urllib3-1.26.19-4.el10_2.2.noarch.rpm	04207175b8d59e5950d06e9e4a57ac737b252dfd381bfbc59930c09834356e8f	-	ol10_x86_64_baseos_latest
	python3-urllib3-1.26.19-4.el10_2.2.noarch.rpm	04207175b8d59e5950d06e9e4a57ac737b252dfd381bfbc59930c09834356e8f	-	ol10_x86_64_u2_baseos_patch

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team