CVE-2026-97688
Fixed in a distro release EPSS <1%CVSS 6.9
urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0.
Products: urllib3
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | urllib3 | 2.8.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | 2.11.2-r26 |
| Chainguard | airflow-core-2 | 2.11.2-r11 |
| Chainguard | ansible-operator | 1.42.3-r19 |
| Chainguard | ansible-operator-fips | 1.42.3-r16 |
| Chainguard | apache-beam-python-3.11-sdk | 2.76.0-r4 |
| Chainguard | apache-beam-python-3.12-sdk | 2.76.0-r4 |
| Chainguard | apache-beam-python-3.13-sdk | 2.76.0-r4 |
| Chainguard | apache-beam-python-3.14-sdk | 2.76.0-r4 |
| Chainguard | aws-cli-1 | 1.46.1-r1 |
| Chainguard | awx | 24.6.1-r65 |
| Chainguard | awx | 24.6.1-r64 |
| Chainguard | commercial-gitlab-toolbox-ee-19.1 | 19.1.8-r1 |
| Chainguard | commercial-gitlab-toolbox-ee-fips-19.1 | 19.1.8-r1 |
| Chainguard | confluent-docker-utils | no fix |
| Chainguard | confluent-docker-utils | 0.0.172-r4 |
| Chainguard | datadog-agent-7.77-core-integrations | 7.77.3-r27 |
| Chainguard | datadog-agent-7.78 | 7.78.4-r23 |
| Chainguard | datadog-agent-7.78-core-integrations | no fix |
| Chainguard | datadog-agent-7.79 | no fix |
| Chainguard | datadog-agent-7.79-core-integrations | no fix |
| Chainguard | datadog-agent-7.80 | no fix |
| Chainguard | datadog-agent-7.80-core-integrations | no fix |
| Chainguard | datadog-agent-7.81 | 7.81.3-r10 |
| Chainguard | datadog-agent-7.81-core-integrations | no fix |
| Chainguard | datadog-agent-7.82 | 7.82.3-r7 |
| Chainguard | datadog-agent-7.82-core-integrations | no fix |
| Chainguard | datadog-agent-7.83 | 7.83.3-r3 |
| Chainguard | datadog-agent-7.83-core-integrations | no fix |
| Chainguard | datadog-agent-7.84-core-integrations | 7.84.0-r1 |
| Chainguard | datadog-agent-fips-7.77 | 7.77.3-r39 |
| Chainguard | datadog-agent-fips-7.77-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.78 | 7.78.4-r20 |
| Chainguard | datadog-agent-fips-7.78-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.79 | no fix |
| Chainguard | datadog-agent-fips-7.79-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.80 | 7.80.4-r22 |
| Chainguard | datadog-agent-fips-7.80-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.81 | 7.81.3-r13 |
| Chainguard | datadog-agent-fips-7.81-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.82 | 7.82.3-r10 |
| Chainguard | datadog-agent-fips-7.82-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.83 | 7.83.3-r4 |
| Chainguard | datadog-agent-fips-7.83-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.84-core-integrations | 7.84.2-r3 |
| Chainguard | datahub-ingestion-fips | 1.7.0.1-r3 |
| Chainguard | graalvm-25-graalpy-venv | 25.0.4.1-r5 |
| Chainguard | graalvm-25-graalpy-venv | 25.0.4.1-r6 |
| Chainguard | jupyterhub-k8s-singleuser-sample | 4.4.2-r4 |
| Chainguard | jwt-tool | 2.3.0-r7 |
| Chainguard | keep-api-fips | 0.54.3-r3 |
| Chainguard | kserve-huggingfaceserver-cuda-13.3 | 0.21.0-r2 |
| Chainguard | kserve-storage-controller | 0.21.0-r2 |
| Chainguard | kubeflow-pipelines-apiserver | 2.17.2-r8 |
| Chainguard | kubeflow-pipelines-apiserver-fips | 2.17.2-r5 |
| Chainguard | kubeflow-pipelines-visualization-server | 2.17.2-r4 |
| Chainguard | litellm | 1.103.2-r2 |
| Chainguard | localstack | 4.14.0-r27 |
| Chainguard | nemo | 2.7.3-r30 |
| Chainguard | nemo-rl-cuda-13.0 | 0.7.0-r3 |
| Chainguard | nemo-rl-cuda-13.0-automodel | 0.7.0-r3 |
| Chainguard | nemo-rl-cuda-13.0-mcore | 0.7.0-r3 |
| Chainguard | nemo-rl-cuda-13.0-sglang | 0.7.0-r3 |
| Chainguard | nemo-rl-cuda-13.0-vllm | 0.7.0-r3 |
| Chainguard | open-webui | 0.11.4-r3 |
| Chainguard | openstack-barbican-2025.2 | 21.0.0_git20260928-r1 |
| Chainguard | openstack-barbican-2026.1 | 22.0.0_git20260928-r1 |
| Chainguard | openstack-ceph-config-helper-2026.1 | 20.2.4-r1 |
| Chainguard | openstack-cinder-2026.1 | 28.0.0_git20260904-r6 |
| Chainguard | openstack-client-2026.1 | 9.0.0_git20260520-r2 |
| Chainguard | openstack-designate-2025.2 | 21.0.1_git20260817-r3 |
| Chainguard | openstack-designate-2026.1 | 22.0.1_git20260827-r3 |
| Chainguard | openstack-glance-2025.1 | 30.2.0_git20260912-r3 |
| Chainguard | openstack-glance-2025.1-fips | 30.2.0_git20260928-r2 |
| Chainguard | openstack-glance-2025.2 | 31.1.0_git20260925-r3 |
| Chainguard | openstack-glance-2025.2-fips | 31.1.0_git20260925-r2 |
| Chainguard | openstack-glance-2026.1 | 32.0.0_git20260930-r3 |
| Chainguard | openstack-glance-2026.1-fips | 32.0.0_git20260930-r3 |
| Chainguard | openstack-heat-2025.2 | 25.0.1_git20260905-r2 |
| Chainguard | openstack-heat-2026.1 | 26.0.1_git20260905-r2 |
| Chainguard | openstack-horizon-2025.1 | 25.3.2_git20260617-r14 |
| Chainguard | openstack-horizon-2025.1-fips | 25.3.2_git20260617-r13 |
| Chainguard | openstack-horizon-2025.2 | 25.5.2_git20260914-r4 |
| Chainguard | openstack-horizon-2025.2-fips | 25.5.2_git20260914-r3 |
| Chainguard | openstack-horizon-2026.1 | 25.7.3_git20260924-r4 |
| Chainguard | openstack-horizon-2026.1-fips | 25.7.3_git20261001-r1 |
| Chainguard | openstack-keystone-2025.1 | 27.0.1_git20260910-r4 |
| Chainguard | openstack-keystone-2025.1-fips | 27.0.1_git20260910-r6 |
| Chainguard | openstack-keystone-2025.2 | 28.0.1_git20260902-r7 |
| Chainguard | openstack-keystone-2025.2-fips | 28.0.1_git20260902-r6 |
| Chainguard | openstack-keystone-2026.1 | 29.0.1_git20260904-r10 |
| Chainguard | openstack-keystone-2026.1-fips | 29.0.1_git20260904-r7 |
| Chainguard | openstack-kolla-toolbox-2025.1 | 20.6.0-r1 |
| Chainguard | openstack-kolla-toolbox-2025.1-fips | 20.6.0-r1 |
| Chainguard | openstack-kolla-toolbox-2025.2 | 21.3.0-r2 |
| Chainguard | openstack-kolla-toolbox-2025.2-fips | 21.3.0-r1 |
| Chainguard | openstack-kolla-toolbox-2026.1 | 22.2.0-r3 |
| Chainguard | openstack-kolla-toolbox-2026.1-fips | 22.2.0-r1 |
| Chainguard | openstack-manila-2025.2 | 21.0.2_git20260923-r2 |
| Chainguard | openstack-manila-2026.1 | 22.0.1_git20260905-r2 |
| Chainguard | openstack-neutron-2026.1 | 28.0.2_git20260928-r5 |
| Chainguard | openstack-nova-2025.1 | 31.3.0_git20260717-r14 |
| Chainguard | openstack-nova-2025.2 | 32.2.0_git20260715-r16 |
| Chainguard | openstack-nova-2026.1 | 33.0.1_git20260819-r13 |
| Chainguard | openstack-octavia-2025.2 | 17.0.1_git20260904-r2 |
| Chainguard | openstack-octavia-2026.1 | 18.0.1_git20260904-r2 |
| Chainguard | openstack-placement-2025.1 | 13.0.0_git20260916-r5 |
| Chainguard | openstack-placement-2025.1-fips | 13.0.0_git20260916-r6 |
| Chainguard | openstack-placement-2025.2 | 14.0.0_git20260916-r6 |
| Chainguard | openstack-placement-2025.2-fips | 14.0.0_git20260916-r6 |
| Chainguard | openstack-placement-2026.1 | 15.0.0_git20260806-r12 |
| Chainguard | openstack-placement-2026.1-fips | 15.0.0_git20260812-r11 |
| Chainguard | openstack-tempest-2025.1 | 43.0.0-r8 |
| Chainguard | openstack-tempest-2025.2 | 45.0.0-r12 |
| Chainguard | openstack-tempest-2026.1 | 46.2.0-r11 |
| Chainguard | pgadmin4-fips | 9.18-r4 |
| Chainguard | presidio-analyzer | 2.2.364-r3 |
| Chainguard | py3-cassandra-medusa | 0.30.1-r2 |
| Chainguard | py3-hashin | 1.0.5-r8 |
| Chainguard | py3.10-opentelemetry-exporter-otlp | 1.40.0-r3 |
| Chainguard | py3.10-pip-base | 26.2.1-r2 |
| Chainguard | py3.10-pipenv | 2026.8.0-r2 |
| Chainguard | py3.11-opentelemetry-exporter-otlp | 1.40.0-r3 |
| Chainguard | py3.11-pip-base | 26.2.1-r2 |
| Chainguard | py3.11-pipenv | 2026.8.0-r2 |
| Chainguard | py3.12-airflow-3 | 3.3.2-r2 |
| Chainguard | py3.12-airflow-core-3 | 3.3.2-r3 |
| Chainguard | py3.12-airflow-postgres-fips-3 | 3.3.2-r2 |
| Chainguard | py3.12-opentelemetry-exporter-otlp | 1.40.0-r3 |
| Chainguard | py3.12-pip-base | 26.2.1-r2 |
| Chainguard | py3.12-pipenv | 2026.8.0-r2 |
| Chainguard | py3.13-airflow-3 | 3.3.2-r2 |
| Chainguard | py3.13-airflow-core-3 | 3.3.2-r3 |
| Chainguard | py3.13-airflow-postgres-fips-3 | 3.3.2-r2 |
| Chainguard | py3.13-opentelemetry-exporter-otlp | 1.40.0-r3 |
| Chainguard | py3.13-pip-base | 26.2.1-r2 |
| Chainguard | py3.13-pipenv | 2026.8.0-r2 |
| Chainguard | py3.13-scanner-test-libraries | no fix |
| Chainguard | py3.14-airflow-3 | 3.3.2-r2 |
| Chainguard | py3.14-airflow-core-3 | 3.3.2-r3 |
| Chainguard | py3.14-airflow-postgres-fips-3 | 3.3.2-r2 |
| Chainguard | py3.14-pip-base | 26.2.1-r2 |
| Chainguard | pypy-3.10 | 7.3.19-r21 |
| Chainguard | request-1276 | 0.30.1-r2 |
| Chainguard | semaphore | 2.19.12-r3 |
| Chainguard | spamcheck | 3.5.3-r15 |
| Chainguard | superset-5.0 | 5.0.0-r38 |
| Chainguard | superset-6.0 | 6.0.0-r18 |
| Chainguard | superset-6.1 | 6.1.0-r11 |
| Chainguard | superset-fips-6.1 | 6.1.0-r7 |
| Chainguard | tensorflow-cpu-jupyter | 2.21.0-r11 |
| Chainguard | tensorflow-gpu-jupyter | 2.21.0-r11 |
| Chainguard | text-generation-inference | no fix |
| Chainguard | wazuh-manager-framework | 4.14.8-r6 |
| Chainguard | wazuh-manager-framework-fips | 4.14.8-r3 |
| Debian 14 | python-urllib3 | 2.8.0-1 |
| Red Hat hummingbird 1 | python-urllib3 | 0:2.8.0-1.hum1 |
| Red Hat hummingbird 1 | python3-urllib3 | 0:2.8.0-1.hum1 |
| Red Hat hummingbird 1 | python3-urllib3+brotli | 0:2.8.0-1.hum1 |
| Red Hat hummingbird 1 | python3-urllib3+h2 | 0:2.8.0-1.hum1 |
| Red Hat hummingbird 1 | python3-urllib3+socks | 0:2.8.0-1.hum1 |
| Red Hat hummingbird 1 | python3-urllib3+zstd | 0:2.8.0-1.hum1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python-urllib3 | 2.0.7-150400.7.36.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python-urllib3 | 1.25.10-150300.4.33.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python-urllib3 | 2.0.7-150400.7.36.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python-urllib3 | 1.25.10-150300.4.33.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | python-urllib3 | 2.0.7-150400.7.36.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | python-urllib3 | 1.25.10-150300.4.33.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | python-urllib3 | 1.25.10-150300.4.33.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | python-urllib3 | 2.0.7-150400.7.36.1 |
| SUSE Linux Enterprise Micro 5.3 | python-urllib3 | 1.25.10-150300.4.33.1 |
| SUSE Linux Enterprise Micro 5.4 | python-urllib3 | 1.25.10-150300.4.33.1 |
| SUSE Linux Enterprise Micro 5.5 | python-urllib3 | 1.25.10-150300.4.33.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | python-urllib3 | 1.25.10-150300.4.33.1 |
| SUSE Linux Enterprise Module for Public Cloud 12 | python-urllib3 | 1.25.10-3.54.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-urllib3 | 2.0.7-150400.7.36.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | python-urllib3 | 2.0.7-150400.7.36.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | python-urllib3 | 1.25.10-3.54.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python-urllib3 | 1.25.10-150300.4.33.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python-urllib3 | 2.0.7-150400.7.36.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | python-urllib3 | 2.0.7-150400.7.36.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | python-urllib3 | 1.25.10-150300.4.33.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | python-urllib3 | 2.0.7-150400.7.36.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | python-urllib3 | 1.25.10-150300.4.33.1 |
| SUSE Linux Enterprise Server 16.0 | python-urllib3 | 2.5.0-160000.8.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | python-urllib3 | 1.25.10-3.54.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python-urllib3 | 1.25.10-150300.4.33.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python-urllib3 | 2.0.7-150400.7.36.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | python-urllib3 | 1.25.10-150300.4.33.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | python-urllib3 | 2.0.7-150400.7.36.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | python-urllib3 | 1.25.10-150300.4.33.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | python-urllib3 | 2.0.7-150400.7.36.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-urllib3 | 2.5.0-160000.8.1 |
| SUSE Linux Micro 6.2 | python-urllib3 | 2.5.0-160000.8.1 |
| Ubuntu 22.04 LTS | python-urllib3 | 1.26.5-1~exp1ubuntu0.8 |
| Ubuntu 24.04 LTS | python-urllib3 | 2.0.7-1ubuntu0.8 |
| Ubuntu 26.04 LTS | python-urllib3 | 2.6.3-1ubuntu1.2 |
| Ubuntu 26.10 | python-pip | no fix |
| Ubuntu Pro 14.04 LTS | python-pip | no fix |
| Ubuntu Pro 16.04 LTS | python-pip | no fix |
| Ubuntu Pro 18.04 LTS | python-pip | no fix |
| Ubuntu Pro 18.04 LTS | python-urllib3 | 1.22-1ubuntu0.18.04.2+esm5 |
| Ubuntu Pro 20.04 LTS | python-pip | no fix |
| Ubuntu Pro 20.04 LTS | python-urllib3 | 1.25.8-2ubuntu0.4+esm6 |
| Ubuntu Pro 22.04 LTS | python-pip | no fix |
| Ubuntu Pro 24.04 LTS | python-pip | no fix |
| Ubuntu Pro 26.04 LTS | python-pip | no fix |
| Wolfi | confluent-docker-utils | no fix |
| Wolfi | confluent-docker-utils | 0.0.172-r4 |
| Wolfi | datadog-agent-7.77-core-integrations | 7.77.3-r27 |
| Wolfi | datadog-agent-7.78 | 7.78.4-r23 |
| Wolfi | datadog-agent-7.78-core-integrations | no fix |
| Wolfi | datadog-agent-7.79 | no fix |
| Wolfi | datadog-agent-7.79-core-integrations | no fix |
| Wolfi | datadog-agent-7.80 | no fix |
| Wolfi | datadog-agent-7.80-core-integrations | no fix |
| Wolfi | datadog-agent-7.81 | 7.81.3-r10 |
| Wolfi | datadog-agent-7.81-core-integrations | no fix |
| Wolfi | jwt-tool | 2.3.0-r7 |
| Wolfi | kserve-storage-controller | 0.21.0-r2 |
| Wolfi | kubeflow-pipelines-apiserver | 2.17.2-r8 |
| Wolfi | kubeflow-pipelines-visualization-server | 2.17.2-r4 |
| Wolfi | open-webui | 0.11.4-r3 |
| Wolfi | py3-cassandra-medusa | 0.30.1-r2 |
| Wolfi | py3.10-pip-base | 26.2.1-r2 |
| Wolfi | py3.10-pipenv | 2026.8.0-r2 |
| Wolfi | py3.11-pip-base | 26.2.1-r2 |
| Wolfi | py3.11-pipenv | 2026.8.0-r2 |
| Wolfi | py3.12-pip-base | 26.2.1-r2 |
| Wolfi | py3.12-pipenv | 2026.8.0-r2 |
| Wolfi | py3.13-pip-base | 26.2.1-r2 |
| Wolfi | py3.13-pipenv | 2026.8.0-r2 |
| Wolfi | py3.14-pip-base | 26.2.1-r2 |
| Wolfi | pypy-3.10 | 7.3.19-r21 |
| Wolfi | superset-6.0 | 6.0.0-r18 |
| Wolfi | superset-6.1 | 6.1.0-r11 |
| openSUSE Leap 16.0 | python-urllib3 | 2.5.0-160000.8.1 |
| openSUSE Tumbleweed | python-urllib3 | 2.8.0-1.1 |
| openSUSE Tumbleweed | python-urllib3_1 | 1.26.20-8.1 |