USN-7955-1: urllib3 vulnerability

USN-7955-1: urllib3 vulnerability

Publication date: 12 January 2026
Overview: urllib3 could be made to use excessive resources if it received specially crafted network traffic.

Packages
python-urllib3 - HTTP library with thread-safe connection pooling

Details
It was discovered that urllib3 incorrectly handled decompression during
HTTP redirects. An attacker could possibly use this issue to cause urllib3
to use excessive resources, causing a denial of service.

Update instructions
The problem can be corrected by updating your system to the following package versions:

• 25.10 questing python3-urllib3 – 2.3.0-3ubuntu0.2
• 25.04 plucky python3-urllib3 – 2.3.0-2ubuntu0.3
• 24.04 LTS noble python3-urllib3 – 2.0.7-1ubuntu0.4
• 22.04 LTS jammy python3-urllib3 – 1.26.5-1~exp1ubuntu0.5
• 20.04 LTS focal python3-urllib3 – 1.25.8-2ubuntu0.4+esm3