ELSA-2026-90494

ELSA-2026-90494 - python-urllib3 security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-26

Description

[1.26.5-8.2]
- CVE-2026-97687 python-urllib3: urllib3: Traffic interception
via HTTPS proxy TLS configuration override
Resolves: RHEL-282326

[1.26.5-8.1]
- CVE-2026-97689 python-urllib3: urllib3: Denial of Service via unbounded
memory allocation in chunk parser
Resolves: RHEL-282267

Related CVEs

CVE-2026-97687

CVE-2026-97689

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	python-urllib3-1.26.5-8.el9_8.2.src.rpm	97c1317b63273556aa71dbdf5a6031aeaffd94ad7fd0f2c600339d95ed447454	-	ol9_aarch64_baseos_latest
	python-urllib3-1.26.5-8.el9_8.2.src.rpm	97c1317b63273556aa71dbdf5a6031aeaffd94ad7fd0f2c600339d95ed447454	-	ol9_aarch64_u8_baseos_patch
	python3-urllib3-1.26.5-8.el9_8.2.noarch.rpm	dd2f1223c0ece5ad6b04cbed675c291ffc4dd2ce5f41e87df2a57f57d0e4ab64	-	ol9_aarch64_baseos_latest
	python3-urllib3-1.26.5-8.el9_8.2.noarch.rpm	dd2f1223c0ece5ad6b04cbed675c291ffc4dd2ce5f41e87df2a57f57d0e4ab64	-	ol9_aarch64_u8_baseos_patch
Oracle Linux 9 (x86_64)	python-urllib3-1.26.5-8.el9_8.2.src.rpm	97c1317b63273556aa71dbdf5a6031aeaffd94ad7fd0f2c600339d95ed447454	-	ol9_x86_64_baseos_latest
	python-urllib3-1.26.5-8.el9_8.2.src.rpm	97c1317b63273556aa71dbdf5a6031aeaffd94ad7fd0f2c600339d95ed447454	-	ol9_x86_64_u8_baseos_patch
	python3-urllib3-1.26.5-8.el9_8.2.noarch.rpm	dd2f1223c0ece5ad6b04cbed675c291ffc4dd2ce5f41e87df2a57f57d0e4ab64	-	ol9_x86_64_baseos_latest
	python3-urllib3-1.26.5-8.el9_8.2.noarch.rpm	dd2f1223c0ece5ad6b04cbed675c291ffc4dd2ce5f41e87df2a57f57d0e4ab64	-	ol9_x86_64_u8_baseos_patch

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team