Skip to main content

urllib3 CVE-2026-21441

HIGH
Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)
2026-01-07 security-advisories@github.com GHSA-38jv-5279-wg99
Python Information Disclosure Urllib3
8.9
CVSS 4.0 · Vendor: github
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure client to attacker-controlled URL
  2. Delivery
    Respond with 3xx redirect + Content-Encoding header
  3. Exploit
    urllib3 auto-drains and decompresses redirect body
  4. Execution
    Compressed bomb expands to gigabytes in memory
  5. Impact
    Client CPU/RAM exhausted, denial of service

Vulnerability Assessment

Weakness
CWE
CWE-409
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V2 - Validation and Business Logic Compression ratio limits
Exploitation Conditions

Exploitation requires that the victim application uses urllib3's streaming mode by setting preload_content=False AND has NOT disabled redirects (redirect defaults to enabled) AND issues requests to a source the attacker controls or can influence. The attacker side needs only the ability to serve an HTTP redirect response with a compressed body (gzip, deflate, br, or zstd) that expands enormously. Limiting factors: it is availability-only (no code execution or data disclosure), it does not trigger against applications that set redirect=False or that fetch only from trusted servers, and it does not affect non-streaming usage (default preload_content=True) in the same redirect-drain path. No user interaction or authentication is needed (PR:N/UI:N), but the AT:P / configuration precondition above is what gates real-world exploitability.
Impact

Signals are mostly consistent and point to a real but bounded (availability-only) issue. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 8.9 High and tracks the impact as VA:H/SA:H with no confidentiality or integrity effect - purely denial of service / resource exhaustion. The AT:P (attack requirements present) flag is important: exploitation is not unconditional, it requires the victim application to be configured for streaming from untrusted sources with redirects enabled, which tempers the otherwise network/unauthenticated profile. EPSS is very low (0.03%, 7th percentile) and there is no KEV listing and no public exploit identified, which is congruent - DoS-only bombs are rarely weaponized at scale and offer no data-theft payoff. Note a labeling caveat: the input Tags include 'Information Disclosure,' which conflicts with the CVSS vector (C:N/VC:N) and the description - this is an availability/resource-exhaustion bug, not information disclosure; treat the tag as inaccurate. Net: prioritize patching because the library is everywhere and Red Hat has shipped numerous errata, but real-world urgency is moderate given availability-only impact, low EPSS, and the configuration precondition.
Exploit ScenarioDerived

An application streams content from a user-supplied or third-party URL using urllib3 with preload_content=False and default redirect handling. An attacker who controls (or can MITM/poison) that endpoint returns an HTTP 3xx redirect whose body carries a Content-Encoding of gzip/br/zstd and decompresses to gigabytes; urllib3 drains and inflates it immediately, exhausting the client's memory or CPU and causing a crash or denial of service. No public exploit is identified at time of analysis, but the technique (decompression bombs) is well documented and trivial to reproduce.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv5 – Jun 30, 2026

Uncontrolled resource consumption in the Python urllib3 HTTP client library (versions 1.22 through 2.6.2) lets a malicious or compromised server crash or exhaust memory on the client by serving a compressed redirect response. When an application streams from an untrusted source with preload_content=False and has not disabled redirects, urllib3 eagerly drains and decompresses the entire redirect body before any read call, ignoring configured read limits, leaving no defense against decompression bombs. EPSS is low (0.03%), there is no public exploit identified at time of analysis, and it is not in CISA KEV, but the bug is broadly reachable given urllib3's ubiquity.

Earlier versions of this analysis (4)
v4 Jun 30, 2026 - 06:15 cvss changed CVSS 8.9

Uncontrolled resource consumption (decompression bomb) in urllib3 from version 1.22 through 2.6.2 lets a malicious or compromised HTTP server exhaust client memory/CPU when an application streams responses with preload_content=False and leaves redirect following enabled. On a redirect response, the library eagerly drained and decompressed the entire body - ignoring configured read limits - so a tiny compressed payload (gzip/deflate/br/zstd) could expand to gigabytes before any read() call. EPSS is very low (0.03%, 7th percentile) and there is no public exploit identified at time of analysis; a vendor patch exists in urllib3 v2.6.3.

v3 Jun 30, 2026 - 06:15 cvss changed CVSS 8.9

Denial-of-service via decompression bomb in the urllib3 Python HTTP client (1.22 through 2.6.2) allows a malicious or compromised server to exhaust client memory/CPU during HTTP redirect handling. When applications stream from untrusted sources (preload_content=False) without disabling redirects, urllib3 fully reads and decompresses the redirect response body to drain the connection - ignoring configured read limits - so a highly compressed payload expands unbounded on the client. No public exploit is identified at time of analysis and EPSS is very low (0.03%), but the flaw affects an extremely widely deployed library and a vendor patch (v2.6.3) plus multiple Red Hat and Debian errata are available.

v2 Jun 30, 2026 - 06:14 cvss changed CVSS 8.9

Uncontrolled resource consumption (decompression bomb) in the Python urllib3 HTTP client library, versions 1.22 through 2.6.2, lets a malicious or compromised HTTP server exhaust client memory and CPU. When an application streams responses from an untrusted source (preload_content=False) without disabling redirects, urllib3 fully reads and decompresses the body of redirect responses before any read call, ignoring configured read limits - so a tiny compressed redirect payload expands to gigabytes. CVSS 4.0 base 8.9, but EPSS is only 0.03% (7th percentile), no public exploit is identified at time of analysis, and the impact is denial of service only (no data exposure).

v1 Mar 12, 2026 - 21:54 CVSS 7.5

urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. [CVSS 7.5 HIGH]

RemediationAI

Vendor-released patch: upgrade urllib3 to at least 2.6.3, in which the library no longer decodes the content of redirect responses when preload_content=False; this is the primary and complete fix (see GHSA-38jv-5279-wg99 and commit 8864ac407bba8607950025e0979c4c69bc7abc7b). On Red Hat or Debian systems, apply the corresponding distribution package updates (e.g., the listed RHSA-2026 errata or the Debian LTS announcement) rather than pip-upgrading a system package. If immediate upgrade is not possible, the vendor-recommended workaround is to set redirect=False on requests to untrusted sources, which eliminates the vulnerable redirect-drain path; the trade-off is that the application must then handle redirects itself or will fail to follow them, so this is safe only where redirects to untrusted hosts are not required. Where feasible, also avoid streaming (leave preload_content at its default) for untrusted endpoints, accepting the higher memory cost of buffering full responses.

Affected Packages

pypi urllib3 fix: 2.6.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

urllib3 is the foundational HTTP client for the Python ecosystem (it underpins requests and countless tools), and its streaming API reads response bodies in chunks while transparently decoding the Content-Encoding header - gzip, deflate, br (Brotli), or zstd. The flaw is a classic CWE-409 (Improper Handling of Highly Compressed Data, i.e., a decompression/data-amplification bomb): for HTTP 3xx redirect responses the library reads the full body to drain the socket so the connection can be reused, and that drain path decompressed the content immediately and unconditionally. Because decompression happened before any user read() and the read limit was not applied to the decompressed stream, a server advertising e.g. gzip could return a few kilobytes that expand to gigabytes, with the amplification fully absorbed by the client. The CPE cpe:2.3:a:python:urllib3 confirms the affected component is the urllib3 package itself, not any single downstream consumer.

Know when Urllib3 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 8.9 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
vuln.today AI 5.9 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because it requires the non-default streaming-plus-redirects-to-untrusted-source configuration; impact is availability-only (A:H, C/I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.5 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
High

Lifecycle Timeline

7
Analysis Updated
Jun 30, 2026 - 06:15 vuln.today
v5 - CVSS changed
Analysis Updated
Jun 30, 2026 - 06:15 vuln.today
v4 - CVSS changed
Analysis Updated
Jun 30, 2026 - 06:15 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 30, 2026 - 06:14 vuln.today
v2 - CVSS changed
CVSS changed
Jun 30, 2026 - 03:23 NVD
7.5 (HIGH) 8.9 (HIGH)
Patch released
Jan 23, 2026 - 09:15 nvd
Patch available
CVE Published
Jan 07, 2026 - 22:15 nvd
HIGH 7.5

DescriptionCVE.org

urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting preload_content=False when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when preload_content=False. If upgrading is not immediately possible, disable redirects by setting redirect=False for requests to untrusted source.

Executive ViewAI

Why It Matters

urllib3, a foundational Python HTTP library used across enterprises, contains a denial-of-service vulnerability (CVE-2026-21441) that allows attackers to crash applications or exhaust memory through compressed redirect responses. No public exploit has been identified at time of analysis, but organizations streaming data from untrusted sources face availability disruption and system resource exhaustion. With CVSS 8.9 and ubiquitous deployment, this vulnerability represents a material operational risk requiring urgent patching.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Prevalence
Ubiquitous
core Python HTTP library underpinning requests; in nearly all Python environments
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*

More in Urllib3

View all
CVE-2024-37891 MEDIUM POC
6.5 Jun 17

urllib3 is a user-friendly HTTP client library for Python. Rated medium severity (CVSS 6.5), this vulnerability is remot
CVE-2019-11236 MEDIUM POC
6.1 Apr 15

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parame
CVE-2018-20060 CRITICAL
9.8 Dec 11

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e.,

CVE-2025-50181 MEDIUM POC
5.3 Jun 19

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all r
CVE-2026-97689 HIGH
8.9 Sep 29

Unbounded memory allocation in urllib3 (1.10.3 through 2.7.x) lets a malicious or machine-in-the-middle HTTP server exha
CVE-2025-66418 HIGH
8.9 Dec 05

Resource-exhaustion denial of service in urllib3 1.24 through 2.5.x allows a malicious or attacker-controlled HTTP serve
CVE-2025-66471 HIGH
8.9 Dec 05

A decompression-bomb denial-of-service flaw in the urllib3 Python HTTP client library (versions 1.0 through 2.5.x, fixed
CVE-2023-43804 HIGH
8.1 Oct 04

urllib3 is a user-friendly HTTP client library for Python. Rated high severity (CVSS 8.1), this vulnerability is remotel
CVE-2026-97687 HIGH
7.6 Sep 29

Certificate validation bypass in urllib3 1.26.0 through 2.7.x allows a man-in-the-middle attacker who can impersonate th
CVE-2021-33503 HIGH
7.5 Jun 29

An issue was discovered in urllib3 before 1.26.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
CVE-2020-7212 HIGH
7.5 Mar 06

The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denia
CVE-2019-11324 HIGH
7.5 Apr 18

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is differ

Same weakness CWE-409 – Improper Handling of Highly Compressed Data (Data Amplification)

View all
CVE-2026-77620 HIGH POC
8.7
CVE-2026-59803 HIGH POC
8.7
CVE-2026-53430 HIGH POC
8.7
CVE-2026-49755 HIGH POC
8.2
CVE-2026-48594 HIGH POC
8.2
CVE-2026-59939 HIGH POC
7.5
CVE-2024-7765 HIGH POC
7.5
CVE-2026-22776 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/manager/4.3/proxy-tftpd:4.3.16.2.9.63.10 Container suse/manager/5.0/x86_64/proxy-tftpd:latest Container suse/manager/5.0/x86_64/server:latest Container suse/multi-linux-manager/5.1/x86_64/proxy-tftpd:5.1.2.8.13.1 Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-GCE-3P Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-GCE-3P Image proxy-tftpd-image Affected
Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.2.9.13.2 Image SLES15-SP4-BYOS-Azure Image SLES15-SP4-Hardened-BYOS-Azure Image SLES15-SP4-SAP Image SLES15-SP4-SAP-BYOS-Azure Image SLES15-SP4-SAP-EC2 Image SLES15-SP4-SAP-Hardened-BYOS-Azure Image SLES15-SP4-SAPCAL Image SLES15-SP4-SAPCAL-EC2 Image SLES15-SP5-Azure-3P Image SLES15-SP5-BYOS-Azure Image SLES15-SP5-EC2 Image SLES15-SP5-Hardened-BYOS-Azure Image SLES15-SP5-SAP-Azure-3P Image SLES15-SP5-SAP-BYOS-Azure Image SLES15-SP5-SAP-Hardened-Azure Image SLES15-SP5-SAP-Hardened-BYOS-Azure Image SLES15-SP5-SAPCAL-EC2 Image SLES15-SP6 Image SLES15-SP6-Azure-3P Image SLES15-SP6-Azure-Basic Image SLES15-SP6-Azure-Standard Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-HPC Image SLES15-SP6-HPC-Azure Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-Azure-3P Image SLES15-SP6-SAP-BYOS-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-Hardened-Azure Image SLES15-SP6-SAP-Hardened-BYOS-Azure Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-HPC-Azure Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image proxy-salt-broker-image Affected
Container suse/multi-linux-manager/5.1/x86_64/server:5.1.2.8.13.2 Image SLES15-SP4-BYOS Image SLES15-SP4-BYOS-EC2 Image SLES15-SP4-HPC-BYOS Image SLES15-SP4-HPC-BYOS-EC2 Image SLES15-SP4-HPC-EC2 Image SLES15-SP4-Hardened-BYOS Image SLES15-SP4-Hardened-BYOS-EC2 Image SLES15-SP4-SAP-BYOS Image SLES15-SP4-SAP-BYOS-EC2 Image SLES15-SP4-SAP-Hardened-BYOS Image SLES15-SP4-SAP-Hardened-BYOS-EC2 Image SLES15-SP5-BYOS-EC2 Image SLES15-SP5-HPC-BYOS-EC2 Image SLES15-SP5-Hardened-BYOS-EC2 Image SLES15-SP5-SAP-BYOS-EC2 Image SLES15-SP5-SAP-Hardened-BYOS-EC2 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-SAP-BYOS Image SLES15-SP6-SAP-BYOS-EC2 Image SLES15-SP6-SAP-Hardened-BYOS Image SLES15-SP6-SAP-Hardened-BYOS-EC2 Image SLES15-SP6-SAP-Hardened-EC2 Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image server-image Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.24 Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.4 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.31 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.36 Affected

References

Advisories & patches
PATCH https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b ADVISORY https://access.redhat.com/errata/RHSA-2026:0981 ADVISORY https://access.redhat.com/errata/RHSA-2026:0990 ADVISORY https://access.redhat.com/errata/RHSA-2026:1038 ADVISORY https://access.redhat.com/errata/RHSA-2026:1041 ADVISORY https://access.redhat.com/errata/RHSA-2026:1042 ADVISORY https://access.redhat.com/errata/RHSA-2026:1086 ADVISORY https://access.redhat.com/errata/RHSA-2026:1087 ADVISORY https://access.redhat.com/errata/RHSA-2026:1088 ADVISORY https://access.redhat.com/errata/RHSA-2026:1089 ADVISORY https://access.redhat.com/errata/RHSA-2026:1166 ADVISORY https://access.redhat.com/errata/RHSA-2026:1168 ADVISORY https://access.redhat.com/errata/RHSA-2026:1176 ADVISORY https://access.redhat.com/errata/RHSA-2026:1224 ADVISORY https://access.redhat.com/errata/RHSA-2026:1226 ADVISORY https://access.redhat.com/errata/RHSA-2026:1239 ADVISORY https://access.redhat.com/errata/RHSA-2026:1240 ADVISORY https://access.redhat.com/errata/RHSA-2026:1241 ADVISORY https://access.redhat.com/errata/RHSA-2026:1254 ADVISORY https://access.redhat.com/errata/RHSA-2026:1485 ADVISORY https://access.redhat.com/errata/RHSA-2026:1504 ADVISORY https://access.redhat.com/errata/RHSA-2026:1546 ADVISORY https://access.redhat.com/errata/RHSA-2026:1596 ADVISORY https://access.redhat.com/errata/RHSA-2026:1599 ADVISORY https://access.redhat.com/errata/RHSA-2026:1609 ADVISORY https://access.redhat.com/errata/RHSA-2026:1618 ADVISORY https://access.redhat.com/errata/RHSA-2026:1619 ADVISORY https://access.redhat.com/errata/RHSA-2026:1652 ADVISORY https://access.redhat.com/errata/RHSA-2026:1674 ADVISORY https://access.redhat.com/errata/RHSA-2026:1676 ADVISORY https://access.redhat.com/errata/RHSA-2026:1693 ADVISORY https://access.redhat.com/errata/RHSA-2026:1704 ADVISORY https://access.redhat.com/errata/RHSA-2026:1706 ADVISORY https://access.redhat.com/errata/RHSA-2026:1712 ADVISORY https://access.redhat.com/errata/RHSA-2026:1717 ADVISORY https://access.redhat.com/errata/RHSA-2026:1726 ADVISORY https://access.redhat.com/errata/RHSA-2026:1729 ADVISORY https://access.redhat.com/errata/RHSA-2026:1730 ADVISORY https://access.redhat.com/errata/RHSA-2026:1734 ADVISORY https://access.redhat.com/errata/RHSA-2026:1735 ADVISORY https://access.redhat.com/errata/RHSA-2026:1736 ADVISORY https://access.redhat.com/errata/RHSA-2026:1791 ADVISORY https://access.redhat.com/errata/RHSA-2026:1792 ADVISORY https://access.redhat.com/errata/RHSA-2026:1793 ADVISORY https://access.redhat.com/errata/RHSA-2026:1794 ADVISORY https://access.redhat.com/errata/RHSA-2026:1803 ADVISORY https://access.redhat.com/errata/RHSA-2026:1805 ADVISORY https://access.redhat.com/errata/RHSA-2026:1942 ADVISORY https://access.redhat.com/errata/RHSA-2026:1957 ADVISORY https://access.redhat.com/errata/RHSA-2026:2106 ADVISORY https://access.redhat.com/errata/RHSA-2026:2126 ADVISORY https://access.redhat.com/errata/RHSA-2026:2137 ADVISORY https://access.redhat.com/errata/RHSA-2026:2139 ADVISORY https://access.redhat.com/errata/RHSA-2026:2144 ADVISORY https://access.redhat.com/errata/RHSA-2026:2256 ADVISORY https://access.redhat.com/errata/RHSA-2026:2456 ADVISORY https://access.redhat.com/errata/RHSA-2026:2500 ADVISORY https://access.redhat.com/errata/RHSA-2026:2563 ADVISORY https://access.redhat.com/errata/RHSA-2026:2681 ADVISORY https://access.redhat.com/errata/RHSA-2026:2695 ADVISORY https://access.redhat.com/errata/RHSA-2026:2717 ADVISORY https://access.redhat.com/errata/RHSA-2026:2718 ADVISORY https://access.redhat.com/errata/RHSA-2026:2723 ADVISORY https://access.redhat.com/errata/RHSA-2026:2728 ADVISORY https://access.redhat.com/errata/RHSA-2026:2760 ADVISORY https://access.redhat.com/errata/RHSA-2026:2762 ADVISORY https://access.redhat.com/errata/RHSA-2026:2764 ADVISORY https://access.redhat.com/errata/RHSA-2026:2765 ADVISORY https://access.redhat.com/errata/RHSA-2026:2900 ADVISORY https://access.redhat.com/errata/RHSA-2026:2911 ADVISORY https://access.redhat.com/errata/RHSA-2026:2919 ADVISORY https://access.redhat.com/errata/RHSA-2026:2924 ADVISORY https://access.redhat.com/errata/RHSA-2026:2925 ADVISORY https://access.redhat.com/errata/RHSA-2026:2926 ADVISORY https://access.redhat.com/errata/RHSA-2026:3296 ADVISORY https://access.redhat.com/errata/RHSA-2026:3406 ADVISORY https://access.redhat.com/errata/RHSA-2026:3444 ADVISORY https://access.redhat.com/errata/RHSA-2026:3461 ADVISORY https://access.redhat.com/errata/RHSA-2026:3462 ADVISORY https://access.redhat.com/errata/RHSA-2026:3713 ADVISORY https://access.redhat.com/errata/RHSA-2026:3782 ADVISORY https://access.redhat.com/errata/RHSA-2026:3869 ADVISORY https://access.redhat.com/errata/RHSA-2026:3874 ADVISORY https://access.redhat.com/errata/RHSA-2026:3884 ADVISORY https://access.redhat.com/errata/RHSA-2026:3960 ADVISORY https://access.redhat.com/errata/RHSA-2026:4185 ADVISORY https://access.redhat.com/errata/RHSA-2026:4215 ADVISORY https://access.redhat.com/errata/RHSA-2026:4271 ADVISORY https://access.redhat.com/errata/RHSA-2026:4466 ADVISORY https://access.redhat.com/errata/RHSA-2026:4467 ADVISORY https://access.redhat.com/errata/RHSA-2026:5459 ADVISORY https://access.redhat.com/errata/RHSA-2026:6287 ADVISORY https://access.redhat.com/errata/RHSA-2026:6292 ADVISORY https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99 ADVISORY https://vuldb.com/vuln/339988 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0255/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0443/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0635/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20131/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20157/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20270/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20364/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20591/ REF https://access.redhat.com/errata/RHSA-2026:10184 REF https://access.redhat.com/errata/RHSA-2026:14877 REF https://access.redhat.com/errata/RHSA-2026:17456 REF https://access.redhat.com/errata/RHSA-2026:17457 REF https://access.redhat.com/errata/RHSA-2026:17460 REF https://access.redhat.com/errata/RHSA-2026:17461 REF https://access.redhat.com/errata/RHSA-2026:17462 REF https://access.redhat.com/errata/RHSA-2026:17463 REF https://access.redhat.com/errata/RHSA-2026:19712 REF https://access.redhat.com/errata/RHSA-2026:25127 REF https://access.redhat.com/errata/RHSA-2026:28043 REF https://access.redhat.com/errata/RHSA-2026:28441 REF https://access.redhat.com/errata/RHSA-2026:33154 REF https://access.redhat.com/errata/RHSA-2026:41928 REF https://access.redhat.com/errata/RHSA-2026:44696 REF https://access.redhat.com/errata/RHSA-2026:51357 REF https://access.redhat.com/errata/RHSA-2026:61628 REF https://access.redhat.com/errata/RHSA-2026:8151 REF https://access.redhat.com/errata/RHSA-2026:8500 REF https://access.redhat.com/errata/RHSA-2026:8501 REF https://access.redhat.com/security/cve/CVE-2026-21441 REF https://bugzilla.redhat.com/show_bug.cgi?id=2427726 REF https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21441.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy