Skip to main content

urllib3 CVE-2025-66418

| EUVDEUVD-2025-201421 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2025-12-05 security-advisories@github.com GHSA-gm62-xv2j-4w53
Denial Of Service Python Urllib3
8.9
CVSS 4.0 · Vendor: github
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure client to malicious/compromised server
  2. Delivery
    Return response with huge Content-Encoding chain
  3. Exploit
    urllib3 builds unbounded decoder chain
  4. Execution
    Decode step exhausts CPU and memory
  5. Impact
    Client process crashes (denial of service)

Vulnerability Assessment

Weakness
CWE
CWE-770
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires the application to use urllib3 (>=1.24, <2.6.0) to make an HTTP request to a server the attacker controls or has compromised, with content decoding enabled (the default). The attacker-controlled response must carry a Content-Encoding header with an excessive chain of encodings. Exploitation is LIMITED by the need for the client to actually connect to a hostile/attacker-influenced endpoint (CVSS 4.0 AT:P), and it is fully mitigated without upgrading by setting preload_content=False and validating resp.headers['content-encoding'] before reading the body. It is not reachable against a passive urllib3 client that only talks to trusted servers, and it produces no data disclosure or code execution - only resource-exhaustion DoS.
Impact

This is a resource-exhaustion denial-of-service (CWE-770) in urllib3, one of the most widely used Python HTTP libraries. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H, 8.9 High) correctly captures a network-reachable, unauthenticated flaw with high availability impact and NO confidentiality or integrity impact - this is purely a DoS, not code execution. The critical nuance is AT:P (Attack Requirement: Present): exploitation requires the urllib3 client to send a request to an attacker-controlled or compromised server, so this is a client-side/outbound-direction issue, not a directly server-facing one. Despite the 8.9 base score, the real-world exploitation signals are low: EPSS is only 0.03% (8th percentile), there is no CISA KEV listing, and no public exploit code is referenced. The severity therefore reflects potential impact (memory/CPU exhaustion crash) rather than likelihood of widespread attack. Practical risk concentrates in applications that fetch content from untrusted or user-supplied URLs (SSRF-adjacent fetchers, webhook callers, crawlers, proxies) with default content-decoding enabled. For most environments this is a patch-on-normal-cycle DoS, elevated in priority only because of urllib3's near-universal footprint across the Python ecosystem, which drove broad distro backports (Ubuntu, Debian, Red Hat).
Exploit ScenarioDerived

An application uses urllib3 (directly or via requests) to fetch content from a URL an attacker can influence or from a server the attacker controls or has compromised. The malicious server returns a response with a Content-Encoding header chaining a very large number of compression steps (e.g., 'gzip, gzip, deflate, ...'), and urllib3 builds an unbounded decoder chain that consumes excessive CPU and allocates massive memory while decoding, crashing or hanging the client process. No public exploit code is referenced, though the fix commit and advisory make the trigger condition trivially reproducible.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 25, 2026

Resource-exhaustion denial of service in urllib3 1.24 through 2.5.x allows a malicious or attacker-controlled HTTP server to drive a Python client into unbounded CPU usage and memory allocation by returning a Content-Encoding header with an arbitrarily long chain of compression algorithms. The library's MultiDecoder previously split the header on commas and instantiated a decoder per token with no cap, so each attacker-supplied link multiplies the decompression work and the size of the decoded body. Exploitation requires the application to connect to a hostile or compromised endpoint with content decoding enabled (the default), and the assessed CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects that prerequisite and the availability-only impact. There is no public exploit code identified at time of analysis and EPSS is low at 0.03% (8th percentile), but urllib3 is embedded in an enormous number of downstream Python packages and tools, so patch coverage across distributions matters more than the headline exploitation signal. The issue is fixed in urllib3 2.6.0, which caps chained encodings at 5.

Earlier versions of this analysis (1)
v1 Mar 15, 2026 - 17:08 CVSS 7.5

RemediationAI

Upgrade to urllib3 2.6.0 or later - the vendor-released patch that enforces a maximum of 5 chained content encodings and raises DecodeError beyond that limit - using pip install --upgrade 'urllib3>=2.6.0' or the equivalent for your dependency manager; prefer this over pinning, since the fix is a hard cap rather than a behavioral workaround. If an immediate upgrade is not possible, the upstream advisory's recommended compensating control is to issue requests with preload_content=False and validate resp.headers['content-encoding'] yourself before reading the response body (reject headers containing more than a small number of comma-separated encodings), then stream the content; the trade-off is added application code and the loss of transparent automatic decoding, plus the risk that future call sites forget the validation. A coarser alternative is to disable content decoding entirely for untrusted endpoints, but that pushes decompression responsibility onto the caller and will break any code that expects a decoded body. For distribution-packaged installs, apply the relevant vendor update rather than reinstalling from PyPI: Ubuntu USN-7927-1 and USN-8010-1, Debian DLA-4421-1 and DSA-6102-1 (bug#1122030), and the Red Hat errata RHSA-2026:1086, RHSA-2026:1726, RHSA-2026:1336, RHSA-2026:1337, RHSA-2026:1224, RHSA-2026:1226, RHSA-2026:1240, and RHSA-2026:1241. Because urllib3 is a transitive dependency for many packages, verify the resolved version in every virtual environment and container image (pip show urllib3, or a dependency scanner) rather than assuming the top-level application constraint covers it. Note that this is an availability-only defect: there is no data disclosure or code execution to mitigate, so effort should be concentrated on inventory and upgrade coverage.

Affected VersionsENISA

urllib3 1.24, < 2.6.0

Affected Packages

pypi urllib3 fix: 2.6.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

urllib3 implements HTTP content decoding for the Content-Encoding header as defined by RFC 9110, which permits chained encodings such as 'Content-Encoding: gzip, zstd'; the response body is fully decoded by applying each listed algorithm in reverse order. The vulnerable implementation lives in src/urllib3/response.py in the MultiDecoder class, which built its decoder list with a simple split on commas (self._decoders = [_get_decoder(m.strip()) for m in modes.split(',')]) without validating how many links the server supplied. This is a textbook CWE-770 (Allocation of Resources Without Limits or Throttling): no upper bound was placed on a resource consumed in proportion to attacker-controlled input, so a single HTTP response could chain hundreds or thousands of compression steps, each requiring CPU time and producing an ever-larger intermediate buffer. The fix (commit 24d7b67eac89f94e11003424bcf0d8f7b72222a8, tracked as GHSA-gm62-xv2j-4w53) introduces a class attribute max_decode_links = 5 and raises DecodeError('Too many content encodings in the chain') when the header exceeds it, with a regression test asserting that six encodings ('gzip, deflate, br, zstd, gzip, deflate') are rejected. The CPE cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* confirms this is the upstream PyPI urllib3 project, and because the flaw is in a client-side decoding path it affects any consumer that pulls in urllib3 - directly or transitively - for outbound HTTP.

Know when Urllib3 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 8.9 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
vuln.today AI 5.9 MEDIUM

Network, unauthenticated, no user interaction, but AC:H reflects the requirement that the client must connect to an attacker-controlled server; impact is availability-only (DoS), so C:N/I:N/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Ubuntu MEDIUM
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.5 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 23:22 NVD
7.5 (HIGH) 8.9 (HIGH)
Patch released
Mar 15, 2026 - 17:08 nvd
Patch available
CVE Published
Dec 05, 2025 - 16:15 cve.org
HIGH 8.9
CVE Published
Dec 05, 2025 - 16:15 nvd
HIGH 7.5

DescriptionCVE.org

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

Executive ViewAI

Why It Matters

urllib3, a widely-used Python HTTP library, contains a denial-of-service vulnerability that allows malicious servers to consume excessive CPU and memory resources through unbounded compression chains. Organizations using urllib3 versions 1.24 through 2.5.x in production systems face service disruption risks if exploited, requiring immediate patching to version 2.6.0 or later.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible, implement network-level controls: restrict HTTP connections to trusted servers only, deploy WAF rules to detect and block excessive compression headers, implement request size limits and timeout policies, and monitor for abnormal CPU/memory spikes correlated with HTTP traffic.

Threat Intelligence Overview

EPSS Score
0.0%
Top 92% exploitable
Prevalence
Ubiquitous
urllib3 is a core Python HTTP dependency (requests) in vast numbers of deployments
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Urllib3

View all
CVE-2024-37891 MEDIUM POC
6.5 Jun 17

urllib3 is a user-friendly HTTP client library for Python. Rated medium severity (CVSS 6.5), this vulnerability is remot
CVE-2019-11236 MEDIUM POC
6.1 Apr 15

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parame
CVE-2018-20060 CRITICAL
9.8 Dec 11

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e.,

CVE-2025-50181 MEDIUM POC
5.3 Jun 19

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all r
CVE-2026-97689 HIGH
8.9 Sep 29

Unbounded memory allocation in urllib3 (1.10.3 through 2.7.x) lets a malicious or machine-in-the-middle HTTP server exha
CVE-2025-66471 HIGH
8.9 Dec 05

A decompression-bomb denial-of-service flaw in the urllib3 Python HTTP client library (versions 1.0 through 2.5.x, fixed
CVE-2026-21441 HIGH
8.9 Jan 07

Uncontrolled resource consumption in the Python urllib3 HTTP client library (versions 1.22 through 2.6.2) lets a malicio
CVE-2023-43804 HIGH
8.1 Oct 04

urllib3 is a user-friendly HTTP client library for Python. Rated high severity (CVSS 8.1), this vulnerability is remotel
CVE-2026-97687 HIGH
7.6 Sep 29

Certificate validation bypass in urllib3 1.26.0 through 2.7.x allows a man-in-the-middle attacker who can impersonate th
CVE-2021-33503 HIGH
7.5 Jun 29

An issue was discovered in urllib3 before 1.26.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
CVE-2020-7212 HIGH
7.5 Mar 06

The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denia
CVE-2019-11324 HIGH
7.5 Apr 18

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is differ

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2024-28182 MEDIUM
5.3
CVE-2023-2650 MEDIUM
6.5
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2022-32206 MEDIUM POC
6.5
CVE-2023-24998 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
python-urllib3
Release Status Version
upstream needs-triage -
bionic not-affected code not present
focal released 1.25.8-2ubuntu0.4+esm2
jammy released 1.26.5-1~exp1ubuntu0.4
trusty not-affected code not present
xenial not-affected code not present
noble released 2.0.7-1ubuntu0.3
plucky released 2.3.0-2ubuntu0.2
questing released 2.3.0-3ubuntu0.1
python-pip
Release Status Version
upstream needs-triage -
bionic not-affected code not present
jammy needed -
noble needed -
questing needed -
trusty not-affected code not present
xenial not-affected code not present
plucky ignored end of life, was needed
focal released 20.0.2-5ubuntu1.11+esm4
USN-7927-1 USN-8010-1

Debian

Bug #1122030
python-urllib3
Release Status Fixed Version Urgency
bullseye fixed 1.26.5-1~exp1+deb11u2 -
bullseye (security) fixed 1.26.5-1~exp1+deb11u3 -
bookworm fixed 1.26.12-1+deb12u2 -
bookworm (security) fixed 1.26.12-1+deb12u3 -
trixie (security), trixie fixed 2.3.0-3+deb13u1 -
forky, sid fixed 2.6.3-1 -
trixie fixed 2.3.0-3+deb13u1 -
(unstable) fixed 2.5.0-1.1 -
DLA-4421-1 DSA-6102-1

SUSE

Severity: High
Product Status
Container suse/manager/4.3/proxy-tftpd:4.3.16.2.9.63.10 Container suse/manager/5.0/x86_64/proxy-tftpd:latest Container suse/manager/5.0/x86_64/server:latest Container suse/multi-linux-manager/5.1/x86_64/proxy-tftpd:5.1.2.8.13.1 Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-GCE-3P Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-GCE-3P Image proxy-tftpd-image Affected
Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.2.9.13.2 Image SLES15-SP6 Image SLES15-SP6-Azure-3P Image SLES15-SP6-Azure-Basic Image SLES15-SP6-Azure-Standard Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-HPC Image SLES15-SP6-HPC-Azure Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-Azure-3P Image SLES15-SP6-SAP-BYOS-Azure Image SLES15-SP6-SAP-Hardened-Azure Image SLES15-SP6-SAP-Hardened-BYOS-Azure Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-HPC-Azure Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image proxy-salt-broker-image Affected
Container suse/multi-linux-manager/5.1/x86_64/server:5.1.2.8.13.2 Image SLES15-SP4-BYOS Image SLES15-SP4-BYOS-EC2 Image SLES15-SP4-HPC-BYOS Image SLES15-SP4-HPC-BYOS-EC2 Image SLES15-SP4-HPC-EC2 Image SLES15-SP4-Hardened-BYOS Image SLES15-SP4-Hardened-BYOS-EC2 Image SLES15-SP4-SAP-BYOS Image SLES15-SP4-SAP-BYOS-EC2 Image SLES15-SP4-SAP-Hardened-BYOS Image SLES15-SP4-SAP-Hardened-BYOS-EC2 Image SLES15-SP5-BYOS-EC2 Image SLES15-SP5-HPC-BYOS-EC2 Image SLES15-SP5-Hardened-BYOS-EC2 Image SLES15-SP5-SAP-BYOS-EC2 Image SLES15-SP5-SAP-Hardened-BYOS-EC2 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-SAP-BYOS Image SLES15-SP6-SAP-BYOS-EC2 Image SLES15-SP6-SAP-Hardened-BYOS Image SLES15-SP6-SAP-Hardened-BYOS-EC2 Image SLES15-SP6-SAP-Hardened-EC2 Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image server-image Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.24 Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.4 Affected

References

Advisories & patches
PATCH https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8 ADVISORY https://access.redhat.com/errata/RHSA-2026:0050 ADVISORY https://access.redhat.com/errata/RHSA-2026:0414 ADVISORY https://access.redhat.com/errata/RHSA-2026:0990 ADVISORY https://access.redhat.com/errata/RHSA-2026:1026 ADVISORY https://access.redhat.com/errata/RHSA-2026:1027 ADVISORY https://access.redhat.com/errata/RHSA-2026:1041 ADVISORY https://access.redhat.com/errata/RHSA-2026:1042 ADVISORY https://access.redhat.com/errata/RHSA-2026:1086 ADVISORY https://access.redhat.com/errata/RHSA-2026:1087 ADVISORY https://access.redhat.com/errata/RHSA-2026:1088 ADVISORY https://access.redhat.com/errata/RHSA-2026:1089 ADVISORY https://access.redhat.com/errata/RHSA-2026:1168 ADVISORY https://access.redhat.com/errata/RHSA-2026:1176 ADVISORY https://access.redhat.com/errata/RHSA-2026:1224 ADVISORY https://access.redhat.com/errata/RHSA-2026:1226 ADVISORY https://access.redhat.com/errata/RHSA-2026:1239 ADVISORY https://access.redhat.com/errata/RHSA-2026:1240 ADVISORY https://access.redhat.com/errata/RHSA-2026:1241 ADVISORY https://access.redhat.com/errata/RHSA-2026:1254 ADVISORY https://access.redhat.com/errata/RHSA-2026:1329 ADVISORY https://access.redhat.com/errata/RHSA-2026:1330 ADVISORY https://access.redhat.com/errata/RHSA-2026:1331 ADVISORY https://access.redhat.com/errata/RHSA-2026:1332 ADVISORY https://access.redhat.com/errata/RHSA-2026:1336 ADVISORY https://access.redhat.com/errata/RHSA-2026:1337 ADVISORY https://access.redhat.com/errata/RHSA-2026:1338 ADVISORY https://access.redhat.com/errata/RHSA-2026:1339 ADVISORY https://access.redhat.com/errata/RHSA-2026:1340 ADVISORY https://access.redhat.com/errata/RHSA-2026:1485 ADVISORY https://access.redhat.com/errata/RHSA-2026:1504 ADVISORY https://access.redhat.com/errata/RHSA-2026:1546 ADVISORY https://access.redhat.com/errata/RHSA-2026:1618 ADVISORY https://access.redhat.com/errata/RHSA-2026:1619 ADVISORY https://access.redhat.com/errata/RHSA-2026:1652 ADVISORY https://access.redhat.com/errata/RHSA-2026:1674 ADVISORY https://access.redhat.com/errata/RHSA-2026:1676 ADVISORY https://access.redhat.com/errata/RHSA-2026:1693 ADVISORY https://access.redhat.com/errata/RHSA-2026:1701 ADVISORY https://access.redhat.com/errata/RHSA-2026:1702 ADVISORY https://access.redhat.com/errata/RHSA-2026:1704 ADVISORY https://access.redhat.com/errata/RHSA-2026:1712 ADVISORY https://access.redhat.com/errata/RHSA-2026:1726 ADVISORY https://access.redhat.com/errata/RHSA-2026:1729 ADVISORY https://access.redhat.com/errata/RHSA-2026:1730 ADVISORY https://access.redhat.com/errata/RHSA-2026:1736 ADVISORY https://access.redhat.com/errata/RHSA-2026:1942 ADVISORY https://access.redhat.com/errata/RHSA-2026:1957 ADVISORY https://access.redhat.com/errata/RHSA-2026:2106 ADVISORY https://access.redhat.com/errata/RHSA-2026:2126 ADVISORY https://access.redhat.com/errata/RHSA-2026:2137 ADVISORY https://access.redhat.com/errata/RHSA-2026:2139 ADVISORY https://access.redhat.com/errata/RHSA-2026:2144 ADVISORY https://access.redhat.com/errata/RHSA-2026:2256 ADVISORY https://access.redhat.com/errata/RHSA-2026:2279 ADVISORY https://access.redhat.com/errata/RHSA-2026:2456 ADVISORY https://access.redhat.com/errata/RHSA-2026:2500 ADVISORY https://access.redhat.com/errata/RHSA-2026:2563 ADVISORY https://access.redhat.com/errata/RHSA-2026:2681 ADVISORY https://access.redhat.com/errata/RHSA-2026:2695 ADVISORY https://access.redhat.com/errata/RHSA-2026:2717 ADVISORY https://access.redhat.com/errata/RHSA-2026:2718 ADVISORY https://access.redhat.com/errata/RHSA-2026:2723 ADVISORY https://access.redhat.com/errata/RHSA-2026:2728 ADVISORY https://access.redhat.com/errata/RHSA-2026:2737 ADVISORY https://access.redhat.com/errata/RHSA-2026:2754 ADVISORY https://access.redhat.com/errata/RHSA-2026:2762 ADVISORY https://access.redhat.com/errata/RHSA-2026:2764 ADVISORY https://access.redhat.com/errata/RHSA-2026:2765 ADVISORY https://access.redhat.com/errata/RHSA-2026:2800 ADVISORY https://access.redhat.com/errata/RHSA-2026:2900 ADVISORY https://access.redhat.com/errata/RHSA-2026:2919 ADVISORY https://access.redhat.com/errata/RHSA-2026:2924 ADVISORY https://access.redhat.com/errata/RHSA-2026:2925 ADVISORY https://access.redhat.com/errata/RHSA-2026:2926 ADVISORY https://access.redhat.com/errata/RHSA-2026:3296 ADVISORY https://access.redhat.com/errata/RHSA-2026:3406 ADVISORY https://access.redhat.com/errata/RHSA-2026:3444 ADVISORY https://access.redhat.com/errata/RHSA-2026:3461 ADVISORY https://access.redhat.com/errata/RHSA-2026:3462 ADVISORY https://access.redhat.com/errata/RHSA-2026:3713 ADVISORY https://access.redhat.com/errata/RHSA-2026:3782 ADVISORY https://access.redhat.com/errata/RHSA-2026:3869 ADVISORY https://access.redhat.com/errata/RHSA-2026:3874 ADVISORY https://access.redhat.com/errata/RHSA-2026:4185 ADVISORY https://access.redhat.com/errata/RHSA-2026:4215 ADVISORY https://access.redhat.com/errata/RHSA-2026:4271 ADVISORY https://access.redhat.com/errata/RHSA-2026:4466 ADVISORY https://access.redhat.com/errata/RHSA-2026:4467 ADVISORY https://access.redhat.com/errata/RHSA-2026:5807 ADVISORY https://access.redhat.com/errata/RHSA-2026:6292 ADVISORY https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-66418 ADVISORY https://security-tracker.debian.org/tracker/dla-4421-1 ADVISORY https://security-tracker.debian.org/tracker/dsa-6102-1 ADVISORY https://ubuntu.com/security/notices/USN-7927-1 ADVISORY https://ubuntu.com/security/notices/USN-8010-1 ADVISORY https://vuldb.com/vuln/334498 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0367/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0443/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0635/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20175/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20189/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20443/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20485/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20591/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy