SUSE-SU-2026:4948-1: Security update for python-urllib3_1

Q: Which systems are covered by this update?

The update applies to python-urllib3_1 on SUSE Linux Enterprise Server for SAP Applications 15 SP6, openSUSE Leap 15.6, the SUSE Python 3 Module 15-SP7, and SUSE Linux Enterprise Server 15 SP6 LTSS.

Q: What conditions could lead to traffic interception?

The traffic-interception issue involves a possible override of HTTPS proxy TLS configuration. Systems using HTTPS proxies are the relevant exposure scenario described by the advisory.

Q: What denial-of-service conditions are addressed?

One issue can cause an infinite loop while decoding chunked Deflate content, and another can cause unbounded memory allocation in the chunk parser. Either condition could allow denial of service when affected parsing paths are reached.

Published Oct 30, 2026

Updated

This update for python-urllib31 fixes the following issues:

- CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override (bsc#1283908). - CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding (bsc#1283909). - CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser (bsc#1283910).

Other sources

This update for python-urllib31 fixes the following issues: CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override (bsc#1283908). CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding (bsc#1283909). CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser (bsc#1283910).

— SUSE

Affected Software

7 affected componentsFixes available

suse/python-urllib3_1<1.26.18-150600.3.14.1

1.26.18-150600.3.14.1

suse/python-urllib3_1<1.26.18-150600.3.14.1

1.26.18-150600.3.14.1

suse/python-urllib3_1<1.26.18-150600.3.14.1

1.26.18-150600.3.14.1

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)

SUSE openSUSE Leap 15.6 (noarch)

SUSE Python 3 Module 15-SP7 (noarch)

SUSE SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)

Event History

Oct 30, 2026

Advisory Published

via OSV·09:56 AM

Data Sourced

via OSV·09:56 AM

DescriptionAffected Software

Advisory Published

via SUSE·09:56 AM

Data Sourced

via SUSE·09:56 AM

RemedyDescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which systems are covered by this update?

The update applies to python-urllib3_1 on SUSE Linux Enterprise Server for SAP Applications 15 SP6, openSUSE Leap 15.6, the SUSE Python 3 Module 15-SP7, and SUSE Linux Enterprise Server 15 SP6 LTSS.

What conditions could lead to traffic interception?

The traffic-interception issue involves a possible override of HTTPS proxy TLS configuration. Systems using HTTPS proxies are the relevant exposure scenario described by the advisory.

What denial-of-service conditions are addressed?

One issue can cause an infinite loop while decoding chunked Deflate content, and another can cause unbounded memory allocation in the chunk parser. Either condition could allow denial of service when affected parsing paths are reached.

SUSE-SU-2026:4948-1: Security update for python-urllib3_1

Other sources

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are covered by this update?

What conditions could lead to traffic interception?

What denial-of-service conditions are addressed?

Company

Resources

Contact

Frequently Asked Questions

Which systems are covered by this update?

What conditions could lead to traffic interception?

What denial-of-service conditions are addressed?