8.9

CVE-2026-97689: python urllib3

CVSS: 8.9v4.0HighAnalyzed
AliasesGHSA-vxq7-64xx-v4gwPYSEC-2026-4177UBUNTU-CVE-2026-97689
Published 29-09-2026Last modified 29-09-2026
Open JSON

Vulnerability summary

CVE-2026-97689 is a high (CVSS 8.9) vulnerability in python urllib3. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.4% of scored vulnerabilities.

Overall risk
36/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.9/10
010
High · v4.0 (CVE.org)
EPSS score
0.34%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 8
OPENSUSE-SU-2026:12044-1OPENSUSE-SU-2026:12119-1OPENSUSE-SU-2026:22071-1RHSA-2026:69612RHSA-2026:84577RHSA-2026:84578

Timeline

  1. 29-09-2026
    PublishedVulnerability first disclosed.
  2. 29-09-2026
    Last modifiedVulnerability information updated.

Description

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.

CVSS metrics

9 scores · 7 sources · 2 versions

EPSS trend

Probability

0.34%

Chance of exploitation in the next 30 days

Percentile

25%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

30-09-202620-10-2026
EPSS score
0.34%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard153 products
  • airflow-2< 2.11.2-r26
  • airflow-core-2< 2.11.2-r11
  • ansible-operator< 1.42.3-r19
  • ansible-operator-fips< 1.42.3-r16
  • apache-beam-python-3.11-sdk< 2.76.0-r4
Wolfi28 products
  • confluent-docker-utilsAll versions (No fix recorded) | < 0.0.172-r4
  • datadog-agent-7.77-core-integrations< 7.77.3-r27
  • datadog-agent-7.78< 7.78.4-r23
  • datadog-agent-7.78-core-integrationsAll versions (No fix recorded)
  • datadog-agent-7.79All versions (No fix recorded)
Ubuntu2 products
  • python-pipAll versions (No fix recorded)
  • python-urllib3All versions (No fix recorded) | < 1.22-1ubuntu0.18.04.2+esm5 | < 1.25.8-2ubuntu0.4+esm6 | < 1.26.5-1~exp1ubuntu0.8 | < 2.0.7-1ubuntu0.8 | < 2.6.3-1ubuntu1.2
Debian1 product
  • python-urllib3All versions (No fix recorded) | < 2.8.0-1
PyPI1 product
  • urllib3≥ 1.10.3, < 2.8.0
Python1 product
Urllib31 product

7 vendors · 187 products

References

12 links
Show all 12 references