Sign in Sign up
JA · EN · FR
SecPulse
This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-97689 →
Categories
UBUNTU-CVE-2026-97689

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbo...

Original description

The description as published by the source.

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:Pro:14.04:LTS python-pip
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:16.04:LTS python-urllib3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:16.04:LTS python-pip
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:18.04:LTS python-urllib3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22-1ubuntu0.18.04.2+esm5"}]}]
Ubuntu:Pro:18.04:LTS python-pip
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:20.04:LTS python-urllib3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.8-2ubuntu0.4+esm6"}]}]
Ubuntu:Pro:20.04:LTS python-pip
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS python-urllib3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.5-1~exp1ubuntu0.8"}]}]
Ubuntu:Pro:22.04:LTS python-pip
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS python-urllib3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-1ubuntu0.8"}]}]
Ubuntu:Pro:24.04:LTS python-pip
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10 python-pip
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS python-urllib3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-1ubuntu1.2"}]}]
Ubuntu:Pro:26.04:LTS python-pip
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details