Skip to main content

urllib3 CVE-2025-66471

| EUVDEUVD-2025-201419 HIGH
Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)
2025-12-05 security-advisories@github.com GHSA-2xpw-w6gg-jr37
Python Urllib3
8.9
CVSS 4.0 · Vendor: github
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure client to fetch attacker-controlled URL
  2. Delivery
    Serve tiny highly-compressed response body
  3. Exploit
    urllib3 streaming API over-decompresses in one call
  4. Execution
    Massive memory/CPU allocation on client
  5. Impact
    Application crash or denial of service

Vulnerability Assessment

Weakness
CWE
CWE-409
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V2 - Validation and Business Logic Compression ratio limits
Exploitation Conditions

Exploitation requires the victim application to use urllib3's streaming API (stream(), read(amt=...), read1(), read_chunked(), readinto()) against an HTTP response whose Content-Encoding is a supported compression (gzip, deflate, br, or zstd) AND whose body is controlled or influenced by an attacker (untrusted server, proxied/fetched content, or a server the attacker can compromise). It does NOT trigger when the app disables decoding explicitly. The AT:P attack requirement reflects this gating: the attacker must be able to deliver a highly-compressed response to the client, so purely internal traffic to trusted servers is not at risk. No authentication or user interaction on the target is needed beyond the app performing the request. Affected: urllib3 >= 1.0 and < 2.6.0; fixed in 2.6.0 (plus Brotli >= 1.2.0 / brotlicffi >= 1.2.0.0 if a Brotli backend is present).
Impact

This is a decompression-bomb denial-of-service (CWE-409) in urllib3's streaming API - a genuine resource-exhaustion flaw but NOT a high-real-risk emergency despite the vendor's 8.9 CVSS 4.0 score. The 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H/SA:H) is availability-only: VC:N and VI:N confirm zero confidentiality or integrity impact, so the 'Information Disclosure' tag is inaccurate (this is availability/DoS). The score is inflated primarily by SA:H (subsequent-system availability); the realistic blast radius is the single client process/application that streams attacker-controlled compressed content, and AT:P correctly signals that exploitation is conditional (the victim must stream a compressed response from an untrusted/attacker-influenced source). EPSS is 0.03% (7th percentile) - essentially the lowest tier - consistent with a client-side library DoS that is not remotely mass-exploitable. There is no CISA KEV listing and no public exploit code identified. No SSVC decision block was provided. Net: a legitimate hygiene/patch item that is ubiquitous in footprint but low in urgency; prioritize via routine dependency patching rather than emergency response. The main risk is to services that proxy or fetch compressed content from untrusted servers, where an attacker could trigger CPU/memory exhaustion even when the app requests only a small chunk.
Exploit ScenarioDerived

An attacker operates or compromises an HTTP server (or a URL a victim application fetches) and returns a small, highly compressed body with a Content-Encoding of gzip/deflate/br/zstd. When a Python application using a vulnerable urllib3 streams the response - e.g. read(amt=256) or stream() - urllib3 fully decompresses the payload in one operation, causing massive memory allocation and CPU spikes that can crash or hang the client. No public exploit code is identified, but the decompression-bomb technique is well known and trivial to reproduce.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 25, 2026

A decompression-bomb denial-of-service flaw in the urllib3 Python HTTP client library (versions 1.0 through 2.5.x, fixed in 2.6.0) lets a malicious or compromised server force a client that uses the streaming API against a compressed HTTP response to fully decompress a small, highly compressed body in a single operation. The result is excessive CPU consumption and massive memory allocation on the client, potentially exhausting resources or crashing the process, even when the application only requested a 256-byte chunk. Exploitation requires the victim application to call stream(), read(amt=...), read1(), read_chunked(), or readinto() with content decoding enabled against an attacker-influenced response; the CVSS vector shows PR:N, so no authentication is required on the target, and no public exploit code or in-the-wild activity has been identified. EPSS is just 0.03% (7th percentile), so despite a vendor CVSS 4.0 score of 8.9, real-world risk is currently low and opportunistic scanning is unlikely.

Earlier versions of this analysis (1)
v1 Mar 15, 2026 - 17:08 CVSS 7.5

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed

RemediationAI

Upgrade to urllib3 2.6.0 or later, which bounds decompression to the requested chunk size and also changes the ContentDecoder API; vendor-released patch: 2.6.0. If a Brotli backend is present, upgrade Brotli to at least 1.2.0 or brotlicffi to at least 1.2.0.0 (the patched urllib3[brotli] extra enforces these floors and will otherwise emit a DependencyWarning), and if you maintain custom decompressors, update them to honor the new max_length signature of urllib3.response.ContentDecoder. For distributions, apply the relevant Ubuntu USN-7927-1/2/3, Debian bug #1122029 packages, or the Red Hat RHSA errata listed in the references. Where an immediate upgrade is impossible, the most effective compensating control is to disable decompression for untrusted or attacker-influenced responses by passing decode_content=False (on stream(), read(), read1(), read_chunked(), readinto()) and handling the compressed bytes yourself with a length-limited decompressor; the trade-off is that callers must now do their own decoding and any assumed plain-text body will break. Alternatively, enforce a hard cap on total bytes read per response, or refuse to stream compressed content from untrusted hosts and preload only size-bounded responses, accepting reduced performance and functionality for large downloads. Restricting outbound requests to trusted servers via allow-lists reduces the attack surface but requires maintaining that list, and nothing besides upgrade fully closes the flaw. Patch commit references: https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7 and https://github.com/urllib3/urllib3/commit/d0fde3672e4a4093f7587858dccfc298eb66e46c; advisory: https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37.

Affected VersionsENISA

urllib3 1.0, < 2.6.0

Affected Packages

pypi urllib3 fix: 2.6.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

urllib3 is a widely used Python HTTP client that underpins requests, pip, and much of the Python packaging and API ecosystem, and the affected component is its response-streaming decompression path. When an HTTP response carries a Content-Encoding header (gzip, deflate, br, or zstd), urllib3 wraps the raw socket stream in a streaming decoder (ContentDecoder subclasses such as DeflateDecoder) that reads compressed bytes from the network and decompresses them until the caller's requested chunk size is satisfied, buffering any surplus decompressed output for the next read. The root cause is CWE-409 (Improper Handling of Highly Compressed Data / decompression bomb): the decoder passed no output length limit to the underlying zlib/Brotli/zstd decompressor, so a tiny compressed payload with an extreme compression ratio could be expanded in full during a single call. The upstream patch changes the ContentDecoder API to accept a max_length parameter, feeds zlib's unconsumed_tail back on subsequent calls, tracks unfed data, and adds a has_unconsumed_tail property so decompression is bounded to what was actually requested. The same commit raises the optional Brotli dependency floor from brotli>=1.0.9 to brotli>=1.2.0 (and brotlicffi>=0.8.0 to brotlicffi>=1.2.0.0), because older Brotli bindings could not honor output-length limits and printed a DependencyWarning otherwise. The affected CPE is cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*, mapping to urllib3 versions >= 1.0 and < 2.6.0. Note that public tagging labels this vulnerability as 'Information Disclosure', which does not match the assessed impact: CVE-2025-66471 is purely an availability flaw (C:N/I:N/A:H in the independent assessment), with no confidentiality or integrity loss demonstrated.

Know when Urllib3 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 8.9 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
vuln.today AI 5.9 MEDIUM

Network-reachable but requires the victim to stream attacker-controlled compressed content (AC:H); no auth (PR:N); availability-only impact on the client process (A:H, C/I:N), no scope change.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Ubuntu MEDIUM
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.5 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
High

Lifecycle Timeline

4
Analysis Updated
Sep 25, 2026 - 23:30 vuln.today
v2 - CVSS changed
CVSS changed
Sep 25, 2026 - 23:22 NVD
7.5 (HIGH) 8.9 (HIGH)
Patch released
Mar 15, 2026 - 17:08 nvd
Patch available
CVE Published
Dec 05, 2025 - 17:16 nvd
HIGH 7.5

DescriptionCVE.org

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.

Executive ViewAI

Why It Matters

A high-severity denial-of-service flaw in urllib3, the Python HTTP client library embedded in a large share of Python applications and services, lets a malicious or compromised server exhaust CPU and memory on any client that streams a compressed response; the CVSS vector indicates the attack is unauthenticated from the target's perspective, and no public exploit code or in-the-wild activity has been identified. Because urllib3 is typically a transitive dependency, leadership should care that internet-facing Python services which fetch, proxy, or process attacker-influenced content could be crashed or degraded, even though current exploitation likelihood is very low (EPSS 0.0%, 7th percentile). A vendor fix is already available, so this is a manageable patching exercise rather than an active incident.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Prevalence
Ubiquitous
urllib3 is a core Python HTTP dependency (pip, requests) in most environments
Threat Intel
1
1 source
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Medium

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

More in Urllib3

View all
CVE-2024-37891 MEDIUM POC
6.5 Jun 17

urllib3 is a user-friendly HTTP client library for Python. Rated medium severity (CVSS 6.5), this vulnerability is remot
CVE-2019-11236 MEDIUM POC
6.1 Apr 15

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parame
CVE-2018-20060 CRITICAL
9.8 Dec 11

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e.,

CVE-2025-50181 MEDIUM POC
5.3 Jun 19

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all r
CVE-2026-97689 HIGH
8.9 Sep 29

Unbounded memory allocation in urllib3 (1.10.3 through 2.7.x) lets a malicious or machine-in-the-middle HTTP server exha
CVE-2025-66418 HIGH
8.9 Dec 05

Resource-exhaustion denial of service in urllib3 1.24 through 2.5.x allows a malicious or attacker-controlled HTTP serve
CVE-2026-21441 HIGH
8.9 Jan 07

Uncontrolled resource consumption in the Python urllib3 HTTP client library (versions 1.22 through 2.6.2) lets a malicio
CVE-2023-43804 HIGH
8.1 Oct 04

urllib3 is a user-friendly HTTP client library for Python. Rated high severity (CVSS 8.1), this vulnerability is remotel
CVE-2026-97687 HIGH
7.6 Sep 29

Certificate validation bypass in urllib3 1.26.0 through 2.7.x allows a man-in-the-middle attacker who can impersonate th
CVE-2021-33503 HIGH
7.5 Jun 29

An issue was discovered in urllib3 before 1.26.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
CVE-2020-7212 HIGH
7.5 Mar 06

The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denia
CVE-2019-11324 HIGH
7.5 Apr 18

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is differ

Same weakness CWE-409 – Improper Handling of Highly Compressed Data (Data Amplification)

View all
CVE-2026-77620 HIGH POC
8.7
CVE-2026-59803 HIGH POC
8.7
CVE-2026-53430 HIGH POC
8.7
CVE-2026-49755 HIGH POC
8.2
CVE-2026-48594 HIGH POC
8.2
CVE-2026-59939 HIGH POC
7.5
CVE-2024-7765 HIGH POC
7.5
CVE-2026-22776 HIGH POC
7.5

Vendor StatusVendor

Ubuntu

Priority: Medium
python-urllib3
Release Status Version
upstream needs-triage -
bionic ignored changes too intrusive
focal ignored changes too intrusive
jammy ignored changes too intrusive
trusty ignored changes too intrusive
noble released 2.0.7-1ubuntu0.3
plucky released 2.3.0-2ubuntu0.2
questing released 2.3.0-3ubuntu0.1
xenial ignored changes too intrusive
python-pip
Release Status Version
upstream needs-triage -
bionic ignored changes too intrusive
focal ignored changes too intrusive
jammy ignored changes too intrusive
noble needed -
questing needed -
trusty ignored changes too intrusive
xenial ignored changes too intrusive
plucky ignored end of life, was needed
USN-7927-1 USN-7927-2 USN-7927-3

Debian

Bug #1122029
python-urllib3
Release Status Fixed Version Urgency
bullseye vulnerable 1.26.5-1~exp1 -
bullseye (security) vulnerable 1.26.5-1~exp1+deb11u3 -
bookworm vulnerable 1.26.12-1+deb12u1 -
bookworm (security) vulnerable 1.26.12-1+deb12u3 -
trixie (security), trixie vulnerable 2.3.0-3+deb13u1 -
forky, sid fixed 2.6.3-1 -
(unstable) fixed 2.6.3-1 -

SUSE

Severity: High
Product Status
Container suse/manager/4.3/proxy-tftpd:4.3.17.9.66.3 Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Affected
Container suse/manager/5.0/x86_64/proxy-tftpd:latest Container suse/manager/5.0/x86_64/server:latest Container suse/multi-linux-manager/5.1/x86_64/proxy-tftpd:5.1.2.8.13.1 Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-GCE-3P Image SLES15-SP7-SAP-GCE-3P Image proxy-tftpd-image Affected
Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.2.9.13.2 Image SLES15-SP6 Image SLES15-SP6-Azure-3P Image SLES15-SP6-Azure-Basic Image SLES15-SP6-Azure-Standard Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-HPC Image SLES15-SP6-HPC-Azure Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-Azure-3P Image SLES15-SP6-SAP-BYOS-Azure Image SLES15-SP6-SAP-Hardened-Azure Image SLES15-SP6-SAP-Hardened-BYOS-Azure Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-HPC-Azure Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image proxy-salt-broker-image Affected
Container suse/multi-linux-manager/5.1/x86_64/server:5.1.2.8.13.2 Image SLES15-SP4-BYOS Image SLES15-SP4-BYOS-EC2 Image SLES15-SP4-HPC-BYOS Image SLES15-SP4-HPC-BYOS-EC2 Image SLES15-SP4-HPC-EC2 Image SLES15-SP4-Hardened-BYOS Image SLES15-SP4-Hardened-BYOS-EC2 Image SLES15-SP4-SAP-BYOS Image SLES15-SP4-SAP-BYOS-EC2 Image SLES15-SP4-SAP-Hardened-BYOS Image SLES15-SP4-SAP-Hardened-BYOS-EC2 Image SLES15-SP5-BYOS-EC2 Image SLES15-SP5-HPC-BYOS-EC2 Image SLES15-SP5-Hardened-BYOS-EC2 Image SLES15-SP5-SAP-BYOS-EC2 Image SLES15-SP5-SAP-Hardened-BYOS-EC2 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-SAP-BYOS Image SLES15-SP6-SAP-BYOS-EC2 Image SLES15-SP6-SAP-Hardened-BYOS Image SLES15-SP6-SAP-Hardened-BYOS-EC2 Image SLES15-SP6-SAP-Hardened-EC2 Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image server-image Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.24 Affected

References

Advisories & patches
PATCH https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7 ADVISORY https://access.redhat.com/errata/RHSA-2026:0981 ADVISORY https://access.redhat.com/errata/RHSA-2026:0990 ADVISORY https://access.redhat.com/errata/RHSA-2026:1038 ADVISORY https://access.redhat.com/errata/RHSA-2026:1041 ADVISORY https://access.redhat.com/errata/RHSA-2026:1042 ADVISORY https://access.redhat.com/errata/RHSA-2026:1086 ADVISORY https://access.redhat.com/errata/RHSA-2026:1087 ADVISORY https://access.redhat.com/errata/RHSA-2026:1088 ADVISORY https://access.redhat.com/errata/RHSA-2026:1089 ADVISORY https://access.redhat.com/errata/RHSA-2026:1166 ADVISORY https://access.redhat.com/errata/RHSA-2026:1168 ADVISORY https://access.redhat.com/errata/RHSA-2026:1176 ADVISORY https://access.redhat.com/errata/RHSA-2026:1224 ADVISORY https://access.redhat.com/errata/RHSA-2026:1226 ADVISORY https://access.redhat.com/errata/RHSA-2026:1239 ADVISORY https://access.redhat.com/errata/RHSA-2026:1240 ADVISORY https://access.redhat.com/errata/RHSA-2026:1241 ADVISORY https://access.redhat.com/errata/RHSA-2026:1249 ADVISORY https://access.redhat.com/errata/RHSA-2026:1254 ADVISORY https://access.redhat.com/errata/RHSA-2026:1485 ADVISORY https://access.redhat.com/errata/RHSA-2026:1497 ADVISORY https://access.redhat.com/errata/RHSA-2026:1504 ADVISORY https://access.redhat.com/errata/RHSA-2026:1506 ADVISORY https://access.redhat.com/errata/RHSA-2026:1546 ADVISORY https://access.redhat.com/errata/RHSA-2026:1596 ADVISORY https://access.redhat.com/errata/RHSA-2026:1599 ADVISORY https://access.redhat.com/errata/RHSA-2026:1600 ADVISORY https://access.redhat.com/errata/RHSA-2026:1609 ADVISORY https://access.redhat.com/errata/RHSA-2026:1618 ADVISORY https://access.redhat.com/errata/RHSA-2026:1619 ADVISORY https://access.redhat.com/errata/RHSA-2026:1652 ADVISORY https://access.redhat.com/errata/RHSA-2026:1674 ADVISORY https://access.redhat.com/errata/RHSA-2026:1676 ADVISORY https://access.redhat.com/errata/RHSA-2026:1693 ADVISORY https://access.redhat.com/errata/RHSA-2026:1704 ADVISORY https://access.redhat.com/errata/RHSA-2026:1706 ADVISORY https://access.redhat.com/errata/RHSA-2026:1712 ADVISORY https://access.redhat.com/errata/RHSA-2026:1717 ADVISORY https://access.redhat.com/errata/RHSA-2026:1726 ADVISORY https://access.redhat.com/errata/RHSA-2026:1729 ADVISORY https://access.redhat.com/errata/RHSA-2026:1730 ADVISORY https://access.redhat.com/errata/RHSA-2026:1734 ADVISORY https://access.redhat.com/errata/RHSA-2026:1735 ADVISORY https://access.redhat.com/errata/RHSA-2026:1736 ADVISORY https://access.redhat.com/errata/RHSA-2026:1791 ADVISORY https://access.redhat.com/errata/RHSA-2026:1792 ADVISORY https://access.redhat.com/errata/RHSA-2026:1793 ADVISORY https://access.redhat.com/errata/RHSA-2026:1794 ADVISORY https://access.redhat.com/errata/RHSA-2026:1795 ADVISORY https://access.redhat.com/errata/RHSA-2026:1803 ADVISORY https://access.redhat.com/errata/RHSA-2026:1805 ADVISORY https://access.redhat.com/errata/RHSA-2026:1942 ADVISORY https://access.redhat.com/errata/RHSA-2026:1957 ADVISORY https://access.redhat.com/errata/RHSA-2026:2060 ADVISORY https://access.redhat.com/errata/RHSA-2026:2106 ADVISORY https://access.redhat.com/errata/RHSA-2026:2126 ADVISORY https://access.redhat.com/errata/RHSA-2026:2137 ADVISORY https://access.redhat.com/errata/RHSA-2026:2139 ADVISORY https://access.redhat.com/errata/RHSA-2026:2144 ADVISORY https://access.redhat.com/errata/RHSA-2026:2256 ADVISORY https://access.redhat.com/errata/RHSA-2026:2456 ADVISORY https://access.redhat.com/errata/RHSA-2026:2500 ADVISORY https://access.redhat.com/errata/RHSA-2026:2563 ADVISORY https://access.redhat.com/errata/RHSA-2026:2681 ADVISORY https://access.redhat.com/errata/RHSA-2026:2695 ADVISORY https://access.redhat.com/errata/RHSA-2026:2717 ADVISORY https://access.redhat.com/errata/RHSA-2026:2718 ADVISORY https://access.redhat.com/errata/RHSA-2026:2723 ADVISORY https://access.redhat.com/errata/RHSA-2026:2728 ADVISORY https://access.redhat.com/errata/RHSA-2026:2737 ADVISORY https://access.redhat.com/errata/RHSA-2026:2760 ADVISORY https://access.redhat.com/errata/RHSA-2026:2762 ADVISORY https://access.redhat.com/errata/RHSA-2026:2764 ADVISORY https://access.redhat.com/errata/RHSA-2026:2765 ADVISORY https://access.redhat.com/errata/RHSA-2026:2800 ADVISORY https://access.redhat.com/errata/RHSA-2026:2900 ADVISORY https://access.redhat.com/errata/RHSA-2026:2919 ADVISORY https://access.redhat.com/errata/RHSA-2026:2924 ADVISORY https://access.redhat.com/errata/RHSA-2026:2925 ADVISORY https://access.redhat.com/errata/RHSA-2026:2926 ADVISORY https://access.redhat.com/errata/RHSA-2026:3296 ADVISORY https://access.redhat.com/errata/RHSA-2026:3406 ADVISORY https://access.redhat.com/errata/RHSA-2026:3444 ADVISORY https://access.redhat.com/errata/RHSA-2026:3461 ADVISORY https://access.redhat.com/errata/RHSA-2026:3462 ADVISORY https://access.redhat.com/errata/RHSA-2026:3713 ADVISORY https://access.redhat.com/errata/RHSA-2026:3782 ADVISORY https://access.redhat.com/errata/RHSA-2026:3869 ADVISORY https://access.redhat.com/errata/RHSA-2026:3874 ADVISORY https://access.redhat.com/errata/RHSA-2026:3960 ADVISORY https://access.redhat.com/errata/RHSA-2026:4185 ADVISORY https://access.redhat.com/errata/RHSA-2026:4215 ADVISORY https://access.redhat.com/errata/RHSA-2026:4271 ADVISORY https://access.redhat.com/errata/RHSA-2026:4466 ADVISORY https://access.redhat.com/errata/RHSA-2026:4467 ADVISORY https://access.redhat.com/errata/RHSA-2026:5459 ADVISORY https://access.redhat.com/errata/RHSA-2026:5549 ADVISORY https://access.redhat.com/errata/RHSA-2026:6055 ADVISORY https://access.redhat.com/errata/RHSA-2026:6292 ADVISORY https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-66471 ADVISORY https://ubuntu.com/security/notices/USN-7927-1 ADVISORY https://ubuntu.com/security/notices/USN-7927-2 ADVISORY https://ubuntu.com/security/notices/USN-7927-3 ADVISORY https://vuldb.com/vuln/334497 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0367/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0443/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0635/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1067/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20175/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20189/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20443/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20485/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20591/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy