{"id":"CVE-2026-9375","aliases":["BELL-CVE-2026-9375","DEBIAN-CVE-2026-9375","EUVD-2026-38064","GHSA-mwq6-fg78-p6cq","OESA-2026-2813","OESA-2026-2814","OESA-2026-2815","OESA-2026-2816","RHSA-2026:53459","SUSE-SU-2026:22863-1","SUSE-SU-2026:22937-1","SUSE-SU-2026:23048-1","SUSE-SU-2026:23176-1","SUSE-SU-2026:3397-1","UBUNTU-CVE-2026-9375","openSUSE-SU-2026:21430-1"],"status":"rejected","title":"urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (...","description":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-06-19T18:45:10Z","modified":"2026-10-19T13:00:04Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"py3-urllib3","fixed_in":["2.7.0-r0"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-urllib3","fixed_in":["1.25.9-18.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python-urllib3","fixed_in":["1.26.12-14.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-urllib3","fixed_in":["1.26.18-9.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"python-urllib3","fixed_in":["1.26.18-9.oe2403sp3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-urllib3","fixed_in":["2.5.0-160000.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-urllib3","fixed_in":["2.5.0-160000.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"python-urllib3","fixed_in":["2.5.0-160000.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"python-urllib3","fixed_in":["2.1.0-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"python-urllib3","fixed_in":["2.1.0-slfo.1.1_6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-urllib3","fixed_in":["2.0.7-150400.7.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-urllib3","fixed_in":["2.0.7-150400.7.33.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"python-urllib3","fixed_in":["2.5.0-160000.7.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0-r0"},{"fixed":"2.7.0-r0"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.9-18.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.12-14.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.18-9.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.18-9.oe2403sp3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-160000.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-160000.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-160000.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-slfo.1.1_6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150400.7.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150400.7.33.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.1-2","1.5.4-1","1.5.4-1ubuntu1","1.5.4-1ubuntu3","1.5.4-1ubuntu4","1.5.4-1ubuntu4+esm1","1.5.4-1ubuntu4+esm2","1.5.4-1ubuntu4+esm3","1.5.4-1ubuntu4+esm4","1.5.4-1ubuntu4+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-2","1.7.1-1","1.7.1-1build1","1.7.1-1ubuntu0.1","1.7.1-1ubuntu3","1.7.1-1ubuntu4","1.7.1-1ubuntu4.1","1.7.1-1ubuntu4.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11-1","1.12-1","1.13.1-1","1.13.1-2","1.13.1-2ubuntu0.16.04.1","1.13.1-2ubuntu0.16.04.2","1.13.1-2ubuntu0.16.04.3","1.13.1-2ubuntu0.16.04.4","1.13.1-2ubuntu0.16.04.4+esm1","1.13.1-2ubuntu0.16.04.4+esm2","1.13.1-2ubuntu0.16.04.4+esm3","1.13.1-2ubuntu0.16.04.4+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.6-7ubuntu1","1.5.6-7ubuntu2","8.0.2-7","8.0.3-1","8.0.3-2","8.1.0-1","8.1.0-2","8.1.1-1","8.1.1-2","8.1.1-2ubuntu0.1","8.1.1-2ubuntu0.2","8.1.1-2ubuntu0.4","8.1.1-2ubuntu0.6","8.1.1-2ubuntu0.6+esm2","8.1.1-2ubuntu0.6+esm3","8.1.1-2ubuntu0.6+esm4","8.1.1-2ubuntu0.6+esm5","8.1.1-2ubuntu0.6+esm6","8.1.1-2ubuntu0.6+esm8","8.1.1-2ubuntu0.6+esm10","8.1.1-2ubuntu0.6+esm11","8.1.1-2ubuntu0.6+esm12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1","1.22-1","1.22-1ubuntu0.18.04.1","1.22-1ubuntu0.18.04.2","1.22-1ubuntu0.18.04.2+esm1","1.22-1ubuntu0.18.04.2+esm2","1.22-1ubuntu0.18.04.2+esm3","1.22-1ubuntu0.18.04.2+esm4","1.22-1ubuntu0.18.04.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.1-2","9.0.1-2.3~ubuntu1","9.0.1-2.3~ubuntu1.18.04.1","9.0.1-2.3~ubuntu1.18.04.2","9.0.1-2.3~ubuntu1.18.04.3","9.0.1-2.3~ubuntu1.18.04.4","9.0.1-2.3~ubuntu1.18.04.5","9.0.1-2.3~ubuntu1.18.04.5+esm2","9.0.1-2.3~ubuntu1.18.04.5+esm3","9.0.1-2.3~ubuntu1.18.04.6","9.0.1-2.3~ubuntu1.18.04.6+esm1","9.0.1-2.3~ubuntu1.18.04.7","9.0.1-2.3~ubuntu1.18.04.7+esm1","9.0.1-2.3~ubuntu1.18.04.8","9.0.1-2.3~ubuntu1.18.04.8+esm1","9.0.1-2.3~ubuntu1.18.04.8+esm2","9.0.1-2.3~ubuntu1.18.04.8+esm4","9.0.1-2.3~ubuntu1.18.04.8+esm6","9.0.1-2.3~ubuntu1.18.04.8+esm7","9.0.1-2.3~ubuntu1.18.04.8+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.1-1ubuntu1","1.24.1-1ubuntu2","1.25.8-1","1.25.8-2","1.25.8-2ubuntu0.1","1.25.8-2ubuntu0.2","1.25.8-2ubuntu0.3","1.25.8-2ubuntu0.4","1.25.8-2ubuntu0.4+esm1","1.25.8-2ubuntu0.4+esm2","1.25.8-2ubuntu0.4+esm3","1.25.8-2ubuntu0.4+esm4","1.25.8-2ubuntu0.4+esm5","1.25.8-2ubuntu0.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.1-5","18.1-5build1","18.1-5ubuntu1","20.0.2-2","20.0.2-4","20.0.2-5","20.0.2-5ubuntu1","20.0.2-5ubuntu1.1","20.0.2-5ubuntu1.3","20.0.2-5ubuntu1.4","20.0.2-5ubuntu1.5","20.0.2-5ubuntu1.6","20.0.2-5ubuntu1.7","20.0.2-5ubuntu1.8","20.0.2-5ubuntu1.9","20.0.2-5ubuntu1.10","20.0.2-5ubuntu1.10+esm2","20.0.2-5ubuntu1.11","20.0.2-5ubuntu1.11+esm2","20.0.2-5ubuntu1.11+esm3","20.0.2-5ubuntu1.11+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.5-1~exp1","1.26.5-1~exp1ubuntu0.1","1.26.5-1~exp1ubuntu0.2","1.26.5-1~exp1ubuntu0.3","1.26.5-1~exp1ubuntu0.4","1.26.5-1~exp1ubuntu0.5","1.26.5-1~exp1ubuntu0.6","1.26.5-1~exp1ubuntu0.7","1.26.5-1~exp1ubuntu0.8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.3.4-4","21.3.1+dfsg-3","22.0.2+dfsg-1","22.0.2+dfsg-1ubuntu0.1","22.0.2+dfsg-1ubuntu0.2","22.0.2+dfsg-1ubuntu0.3","22.0.2+dfsg-1ubuntu0.4","22.0.2+dfsg-1ubuntu0.5","22.0.2+dfsg-1ubuntu0.6","22.0.2+dfsg-1ubuntu0.7","22.0.2+dfsg-1ubuntu0.7+esm1","22.0.2+dfsg-1ubuntu0.7+esm2","22.0.2+dfsg-1ubuntu0.7+esm3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.16-1","1.26.18-1","2.0.7-1","2.0.7-1ubuntu0.1","2.0.7-1ubuntu0.2","2.0.7-1ubuntu0.3","2.0.7-1ubuntu0.4","2.0.7-1ubuntu0.5","2.0.7-1ubuntu0.6","2.0.7-1ubuntu0.7","2.0.7-1ubuntu0.8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.2+dfsg-1","23.3+dfsg-1","24.0+dfsg-1","24.0+dfsg-1ubuntu1","24.0+dfsg-1ubuntu1.1","24.0+dfsg-1ubuntu1.2","24.0+dfsg-1ubuntu1.3","24.0+dfsg-1ubuntu1.3+esm1","24.0+dfsg-1ubuntu1.3+esm2","24.0+dfsg-1ubuntu1.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.0+dfsg-1","25.1.1+dfsg-1","25.1.1+dfsg-1ubuntu1","25.1.1+dfsg-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0-2","2.3.0-2ubuntu1","2.3.0-3","2.3.0-3ubuntu0.1","2.3.0-3ubuntu0.2","2.3.0-3ubuntu0.3","2.3.0-3ubuntu0.4","2.3.0-3ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0-3","2.5.0-1","2.5.0-1ubuntu1","2.5.0-1ubuntu2","2.6.3-1ubuntu1","2.6.3-1ubuntu1.1","2.6.3-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.1.1+dfsg-1ubuntu2","25.1.1+dfsg-1ubuntu2+esm1","25.1.1+dfsg-1ubuntu2+esm2","25.1.1+dfsg-1ubuntu2+esm3"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-160000.7.1"}]}]}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9375","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a","tags":["fix","article"]},{"url":"https://huntr.com/bounties/ddd09eb9-b87d-4a43-84df-48837b1bbc23","tags":["web","article","report"]},{"url":"https://github.com/advisories/GHSA-mwq6-fg78-p6cq"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-9375","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9375.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-9375","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2813","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2814","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2815","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2816","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53459","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9375","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53459.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490897","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9375","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622863-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268683","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9375","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622937-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623048-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623176-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263397-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-9375","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-9375","description":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","status":"rejected","published":"2026-06-19T18:45:10.409Z","modified":"2026-08-13T14:39:11.942Z","updated_at":"2026-11-02T13:42:26.790871Z"}],"euvd":[{"id":"EUVD-2026-38064","description":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","status":"published","published":"2026-06-19T18:45:10Z","modified":"2026-08-13T14:39:11Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:56.415282Z"}],"ghsa":[{"id":"GHSA-mwq6-fg78-p6cq","title":"urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (...","description":"urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.","status":"published","published":"2026-06-19T21:32:48Z","modified":"2026-06-19T21:32:59Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:08:55.029086Z"}],"nvd":[{"id":"CVE-2026-9375","description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","status":"rejected","published":"2026-06-19T19:16:36.947Z","modified":"2026-10-16T15:10:00.103Z","updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"BELL-CVE-2026-9375","status":"published","published":"2026-06-23T06:12:38.112841Z","modified":"2026-07-02T07:15:37.05920347Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:27.164451Z"},{"id":"CVE-2026-9375","title":"Decompression Bomb Bypass via Negative max_length in Streaming API in urllib3","description":"urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.","status":"published","published":"2026-06-19T18:45:10.409Z","modified":"2026-08-22T18:49:58.663674086Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:20.931171Z"},{"id":"DEBIAN-CVE-2026-9375","status":"withdrawn","published":"2026-06-19T19:16:36.947Z","modified":"2026-08-14T08:00:38.932793461Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:06.846102Z"},{"id":"OESA-2026-2813","title":"python-urllib3 security update","description":"HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more.\r\n\r\nSecurity Fix(es):\n\nurllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.(CVE-2026-9375)","status":"published","published":"2026-07-06T11:11:44Z","modified":"2026-08-18T01:21:12.438903618Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2814","title":"python-urllib3 security update","description":"HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more.\r\n\r\nSecurity Fix(es):\n\nurllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.(CVE-2026-9375)","status":"published","published":"2026-07-06T11:11:44Z","modified":"2026-08-18T01:21:12.459168343Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2815","title":"python-urllib3 security update","description":"HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more.\r\n\r\nSecurity Fix(es):\n\nurllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.(CVE-2026-9375)","status":"published","published":"2026-07-06T11:11:44Z","modified":"2026-08-18T01:21:12.44377618Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2816","title":"python-urllib3 security update","description":"HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more.\r\n\r\nSecurity Fix(es):\n\nurllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.(CVE-2026-9375)","status":"published","published":"2026-07-06T11:11:44Z","modified":"2026-08-18T01:21:12.446094714Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:53459","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"withdrawn","published":"2026-09-22T10:14:39Z","modified":"2026-10-19T13:00:04.835990482Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"UBUNTU-CVE-2026-9375","description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","status":"published","published":"2026-06-19T19:16:00Z","modified":"2026-10-14T11:47:37.965604919Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"openSUSE-SU-2026:21430-1","title":"Security update for python-urllib3","description":"This update for python-urllib3 fixes the following issue\n\n- CVE-2026-9375: decompression bomb bypass in the streaming API  when using Brotli support can lead to a denial of\n  service (bsc#1268683).\n","status":"published","published":"2026-07-23T09:46:34Z","modified":"2026-07-24T17:16:09.847939641Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22863-1","title":"Security update for python-urllib3","description":"This update for python-urllib3 fixes the following issue\n\n- CVE-2026-9375: decompression bomb bypass in the streaming API  when using Brotli support can lead to a denial of\n  service (bsc#1268683).\n","status":"published","published":"2026-07-23T09:45:44Z","modified":"2026-07-28T18:24:11.834494345Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22937-1","title":"Security update for python-urllib3","description":"This update for python-urllib3 fixes the following issue\n\n- CVE-2026-9375: decompression bomb bypass in the streaming API  when using Brotli support can lead to a denial of\n  service (bsc#1268683).\n","status":"published","published":"2026-07-23T09:45:44Z","modified":"2026-07-29T18:24:21.931212616Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23048-1","title":"Security update for python-urllib3","description":"This update for python-urllib3 fixes the following issue:\n\n- CVE-2026-9375: oversized Brotli payload via the streaming API can lead to a denial of service (bsc#1268683).\n","status":"published","published":"2026-08-03T07:15:53Z","modified":"2026-08-12T18:23:40.05848969Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23176-1","title":"Security update for python-urllib3","description":"This update for python-urllib3 fixes the following issue:\n\n- CVE-2026-9375: oversized Brotli payload via the streaming API can lead to a denial of service (bsc#1268683).\n","status":"published","published":"2026-08-12T10:55:23Z","modified":"2026-08-22T18:23:34.825823962Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3397-1","title":"Security update for python-urllib3","description":"This update for python-urllib3 fixes the following issue\n\n- CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of\n  service (bsc#1268683).\n","status":"published","published":"2026-07-28T18:31:34Z","modified":"2026-07-30T17:15:08.011049292Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}