[Git][security-tracker-team/security-tracker][master] CVEs assigned for urllib3 issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
2824775b by Salvatore Bonaccorso at 2026-09-29T21:30:43+02:00
CVEs assigned for urllib3 issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -2,12 +2,6 @@ CVE-2026-98164 (In the Linux kernel, the following vulnerability has been resolv
 	TODO: check
 CVE-2026-97711 (Serialize JavaScript serializes JavaScript values to a superset of JSO ...)
 	TODO: check
-CVE-2026-97689 (urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, ...)
-	TODO: check
-CVE-2026-97688 (urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0,  ...)
-	TODO: check
-CVE-2026-97687 (urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, ...)
-	TODO: check
 CVE-2026-97395 (Apache Polaris allows an authenticated principal with permission to cr ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-96440 (Improper Limitation of a Pathname to a Restricted Directory\uff08Path  ...)
@@ -10337,17 +10331,22 @@ CVE-2026-93012 (Email::Sender::Transport::Sendmail versions before 2.602 for Per
 	- libemail-sender-perl <not-affected> (Only affects Email::Sender on Windows)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/43733017/
 	NOTE: Fixed by: https://github.com/rjbs/Email-Sender/commit/9a587bc9ff4edae13239190c2651da2c76b1e72c (2.602)
-CVE-2026-XXXX [GHSA-8988-9cw3-xx77: HTTPS proxy TLS configuration may be ignored or overridden]
+CVE-2026-97687 [GHSA-8988-9cw3-xx77: HTTPS proxy TLS configuration may be ignored or overridden]
 	- python-urllib3 2.8.0-1
 	NOTE: https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77
-CVE-2026-XXXX [GHSA-vxq7-64xx-v4gw: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory]
+	NOTE: https://github.com/urllib3/urllib3/pull/5093
+	NOTE: Fixed by: https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465 (2.8.0)
+	NOTE: Fixed by: https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3 (2.8.0)
+CVE-2026-97689 [GHSA-vxq7-64xx-v4gw: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory]
 	- python-urllib3 2.8.0-1
 	NOTE: https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw
-CVE-2026-XXXX [GHSA-gh4c-6fx4-qh6g: Chunked Deflate streaming can enter an infinite loop]
+	NOTE: Fixed by: https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed (2.8.0)
+CVE-2026-97688 [GHSA-gh4c-6fx4-qh6g: Chunked Deflate streaming can enter an infinite loop]
 	- python-urllib3 2.8.0-1
 	[trixie] - python-urllib3 <not-affected> (Vulnerable code not present, introduced in 2.6.2)
 	[bookworm] - python-urllib3 <not-affected> (Vulnerable code not present, introduced in 2.6.2)
 	NOTE: https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g
+	NOTE: Fixed by: https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f (2.8.0)
 CVE-2026-94218 (A flaw was found in the authentication session management of Keycloak, ...)
 	- keycloak <itp> (bug #1088287)
 CVE-2026-94217 (A flaw was found in the User-Managed Access (UMA) implementation of Ke ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2824775b6525fa44783b35e892cbe558c48f2388

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2824775b6525fa44783b35e892cbe558c48f2388
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260929/a9bd164c/attachment-0001.htm>