UbuntuUpdates.org

Package "python-urllib3"

Name: python-urllib3

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • HTTP library with thread-safe connection pooling for Python3
Latest version: 1.26.5-1~exp1ubuntu0.8
Release: jammy (22.04)
Level: updates
Repository: main

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "python-urllib3" in Jammy

Repository Area Version
base main 1.26.5-1~exp1
security main 1.26.5-1~exp1ubuntu0.8

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.26.5-1~exp1ubuntu0.8 2026-10-21 09:07:37 UTC

python-urllib3 (1.26.5-1~exp1ubuntu0.8) jammy-security; urgency=medium

  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2026-97689.patch: Bound chunk-size line reads
      to prevent memory exhaustion DoS
    - CVE-2026-97689

 -- Bruce Cable Tue, 13 Oct 2026 14:01:23 +1100
Source diff to previous version
CVE-2026-97689 urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unb

Version: 1.26.5-1~exp1ubuntu0.7 2026-06-03 18:07:36 UTC

  python-urllib3 (1.26.5-1~exp1ubuntu0.7) jammy-security; urgency=medium

  * SECURITY UPDATE: sensitive headers not stripped in cross-origin redirects
    - debian/patches/CVE-2026-44431.patch: remove sensitive headers in proxy
      pools too in src/urllib3/connectionpool.py,
      test/with_dummyserver/test_proxy_poolmanager.py.
    - CVE-2026-44431

 -- Marc Deslauriers <email address hidden> Fri, 22 May 2026 16:41:35 -0400
Source diff to previous version
CVE-2026-44431 urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.conn

Version: 1.26.5-1~exp1ubuntu0.6 2026-01-19 19:15:35 UTC

  python-urllib3 (1.26.5-1~exp1ubuntu0.6) jammy-security; urgency=medium

  * SECURITY REGRESSION: Missing _has_decoded_content from CVE-2026-21441
    (LP: #2138420)
    - debian/patches/CVE-2026-21441-fix1.patch: Implement _has_decoded_content
      and decoded checks in src/urllib3/response.py. Add tests in
      test/test_response.py.

 -- Hlib Korzhynskyy <email address hidden> Fri, 16 Jan 2026 19:39:26 -0330
Source diff to previous version
2138420 backport of CVE-2026-21441 results in broken package
CVE-2026-21441 urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the c

Version: 1.26.5-1~exp1ubuntu0.5 2026-01-12 21:08:31 UTC

  python-urllib3 (1.26.5-1~exp1ubuntu0.5) jammy-security; urgency=medium

  * SECURITY UPDATE: Decompression bomb in HTTP redirect responses.
    - debian/patches/CVE-2026-21441.patch: Add decode_content to self.read()
      in src/urllib3/response.py. Add tests in
      test/with_dummyserver/test_connectionpool.py.
    - CVE-2026-21441

 -- Hlib Korzhynskyy <email address hidden> Thu, 08 Jan 2026 16:06:10 -0330
Source diff to previous version
CVE-2026-21441 urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the c

Version: 1.26.5-1~exp1ubuntu0.4 2025-12-12 01:08:24 UTC

  python-urllib3 (1.26.5-1~exp1ubuntu0.4) jammy-security; urgency=medium

  * SECURITY UPDATE: Denial of service due to unbounded decompression chain.
    - debian/patches/CVE-2025-66418.patch: Add max_decode_links limit and
      checks in src/urllib3/response.py. Add test in test/test_response.py.
    - CVE-2025-66418

 -- Hlib Korzhynskyy <email address hidden> Wed, 10 Dec 2025 17:29:42 -0330
CVE-2025-66418 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chai


About   -   Send Feedback to @ubuntu_updates