CVE-2026-97689 urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
A malicious HTTP server can cause memory exhaustion in urllib3 clients by sending an unbounded chunk-size line, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97689?
CVE-2026-97689 is a high-severity denial of service vulnerability in urllib3, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.
Weakness: CWE-770
Which versions are affected by CVE-2026-97689?
3 open source packages ship an affected version, including urllib3. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
urllib3 PyPI | From 1.10.3 | 2.8.0 |
urllib3 PyPI | From 1.10.3 | 2.8.0 |
urllib3 PyPI | From 1.10.3 | 2.8.0 |
Linux distribution packages (2)
python3-urllib3 AlmaLinux:8 | All versions | 1.24.2-11.el8_10 |
python-urllib3 Rocky Linux:8 | All versions | 0:1.24.2-11.el8_10 |
Products include Python Urllib3.
How do I fix CVE-2026-97689?
Upgrade urllib3 to 2.8.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-97689 being exploited?
There is no known exploitation of CVE-2026-97689 in the wild and no public exploit code.
Other vulnerabilities in urllib3
- CVE-2026-44432 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
- CVE-2026-21441 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
- CVE-2025-66418 urllib3 allows an unbounded number of links in the decompression chain
- CVE-2025-66471 urllib3 Streaming API improperly handles highly compressed data
- CVE-2026-44431 urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
Sources
Also known as ALSA-2026:90759, AZL-105660, AZL-105915, BELL-CVE-2026-97689, CLEANSTART-2026-DB54467, CLEANSTART-2026-DZ64581 and 49 more.