{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "python313-urllib3-2.8.0-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the python313-urllib3-2.8.0-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-12044",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12044-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-9015 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-9015/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-20060 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-20060/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-11324 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-11324/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9740 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9740/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-26137 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-26137/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-33503 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-33503/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-43804 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-43804/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-45803 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-45803/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-37891 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-37891/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-97687 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-97687/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-97688 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-97688/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-97689 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-97689/"
      }
    ],
    "title": "python313-urllib3-2.8.0-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-10-05T09:19:24Z",
      "generator": {
        "date": "2026-10-04T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:12044-1",
      "initial_release_date": "2026-10-04T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-10-04T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-05T09:19:24Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-urllib3-0:2.8.0-1.1.aarch64",
                "product": {
                  "name": "python313-urllib3-0:2.8.0-1.1.aarch64",
                  "product_id": "python313-urllib3-0:2.8.0-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:python:urllib3:2.8.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-urllib3@2.8.0-1.1?arch=aarch64\u0026upstream=python-urllib3-0:2.8.0-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-urllib3-0:2.8.0-1.1.aarch64",
                "product": {
                  "name": "python314-urllib3-0:2.8.0-1.1.aarch64",
                  "product_id": "python314-urllib3-0:2.8.0-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-urllib3@2.8.0-1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-urllib3-0:2.8.0-1.1.ppc64le",
                "product": {
                  "name": "python313-urllib3-0:2.8.0-1.1.ppc64le",
                  "product_id": "python313-urllib3-0:2.8.0-1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:python:urllib3:2.8.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-urllib3@2.8.0-1.1?arch=ppc64le\u0026upstream=python-urllib3-0:2.8.0-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-urllib3-0:2.8.0-1.1.ppc64le",
                "product": {
                  "name": "python314-urllib3-0:2.8.0-1.1.ppc64le",
                  "product_id": "python314-urllib3-0:2.8.0-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-urllib3@2.8.0-1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-urllib3-0:2.8.0-1.1.s390x",
                "product": {
                  "name": "python313-urllib3-0:2.8.0-1.1.s390x",
                  "product_id": "python313-urllib3-0:2.8.0-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:python:urllib3:2.8.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-urllib3@2.8.0-1.1?arch=s390x\u0026upstream=python-urllib3-0:2.8.0-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-urllib3-0:2.8.0-1.1.s390x",
                "product": {
                  "name": "python314-urllib3-0:2.8.0-1.1.s390x",
                  "product_id": "python314-urllib3-0:2.8.0-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-urllib3@2.8.0-1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-urllib3-0:2.8.0-1.1.x86_64",
                "product": {
                  "name": "python313-urllib3-0:2.8.0-1.1.x86_64",
                  "product_id": "python313-urllib3-0:2.8.0-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:python:urllib3:2.8.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-urllib3@2.8.0-1.1?arch=x86_64\u0026upstream=python-urllib3-0:2.8.0-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-urllib3-0:2.8.0-1.1.x86_64",
                "product": {
                  "name": "python314-urllib3-0:2.8.0-1.1.x86_64",
                  "product_id": "python314-urllib3-0:2.8.0-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-urllib3@2.8.0-1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-urllib3-0:2.8.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64"
        },
        "product_reference": "python313-urllib3-0:2.8.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-urllib3-0:2.8.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le"
        },
        "product_reference": "python313-urllib3-0:2.8.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-urllib3-0:2.8.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x"
        },
        "product_reference": "python313-urllib3-0:2.8.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-urllib3-0:2.8.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64"
        },
        "product_reference": "python313-urllib3-0:2.8.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-urllib3-0:2.8.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64"
        },
        "product_reference": "python314-urllib3-0:2.8.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-urllib3-0:2.8.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le"
        },
        "product_reference": "python314-urllib3-0:2.8.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-urllib3-0:2.8.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x"
        },
        "product_reference": "python314-urllib3-0:2.8.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-urllib3-0:2.8.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
        },
        "product_reference": "python314-urllib3-0:2.8.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-9015",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-9015"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-9015",
          "url": "https://www.suse.com/security/cve/CVE-2016-9015"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1023502 for CVE-2016-9015",
          "url": "https://bugzilla.suse.com/1023502"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1024540 for CVE-2016-9015",
          "url": "https://bugzilla.suse.com/1024540"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2016-9015"
    },
    {
      "cve": "CVE-2018-20060",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-20060"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-20060",
          "url": "https://www.suse.com/security/cve/CVE-2018-20060"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1119376 for CVE-2018-20060",
          "url": "https://bugzilla.suse.com/1119376"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216275 for CVE-2018-20060",
          "url": "https://bugzilla.suse.com/1216275"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-20060"
    },
    {
      "cve": "CVE-2019-11324",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-11324"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-11324",
          "url": "https://www.suse.com/security/cve/CVE-2019-11324"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1132900 for CVE-2019-11324",
          "url": "https://bugzilla.suse.com/1132900"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2019-11324"
    },
    {
      "cve": "CVE-2019-9740",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9740"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9740",
          "url": "https://www.suse.com/security/cve/CVE-2019-9740"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1129071 for CVE-2019-9740",
          "url": "https://bugzilla.suse.com/1129071"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1130840 for CVE-2019-9740",
          "url": "https://bugzilla.suse.com/1130840"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1132663 for CVE-2019-9740",
          "url": "https://bugzilla.suse.com/1132663"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-9740"
    },
    {
      "cve": "CVE-2020-26137",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-26137"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-26137",
          "url": "https://www.suse.com/security/cve/CVE-2020-26137"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1177120 for CVE-2020-26137",
          "url": "https://bugzilla.suse.com/1177120"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1177211 for CVE-2020-26137",
          "url": "https://bugzilla.suse.com/1177211"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-26137"
    },
    {
      "cve": "CVE-2021-33503",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-33503"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-33503",
          "url": "https://www.suse.com/security/cve/CVE-2021-33503"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187045 for CVE-2021-33503",
          "url": "https://bugzilla.suse.com/1187045"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-33503"
    },
    {
      "cve": "CVE-2023-43804",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-43804"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn\u0027t treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn\u0027t disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-43804",
          "url": "https://www.suse.com/security/cve/CVE-2023-43804"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1215968 for CVE-2023-43804",
          "url": "https://bugzilla.suse.com/1215968"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-43804"
    },
    {
      "cve": "CVE-2023-45803",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-45803"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn\u0027t remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren\u0027t putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn\u0027t exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren\u0027t expecting to respond with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stripping the HTTP request body.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-45803",
          "url": "https://www.suse.com/security/cve/CVE-2023-45803"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216377 for CVE-2023-45803",
          "url": "https://bugzilla.suse.com/1216377"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-45803"
    },
    {
      "cve": "CVE-2024-37891",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-37891"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": " urllib3 is a user-friendly HTTP client library for Python. When using urllib3\u0027s proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3\u0027s proxy support, it\u0027s possible to accidentally configure the `Proxy-Authorization` header even though it won\u0027t have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn\u0027t treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn\u0027t strip the header on cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are doing this on accident. Users should use urllib3\u0027s proxy support or disable automatic redirects to achieve safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default in order to further protect users who aren\u0027t using the correct approach. We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting the `Proxy-Authorization` header without using urllib3\u0027s built-in proxy support. 2. Not disabling HTTP redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to upgrade may use the `Proxy-Authorization` header with urllib3\u0027s `ProxyManager`, disable HTTP redirects using `redirects=False` when sending requests, or not user the `Proxy-Authorization` header as mitigations.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-37891",
          "url": "https://www.suse.com/security/cve/CVE-2024-37891"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1226469 for CVE-2024-37891",
          "url": "https://bugzilla.suse.com/1226469"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-37891"
    },
    {
      "cve": "CVE-2026-97687",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-97687"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker\u0027s certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-97687",
          "url": "https://www.suse.com/security/cve/CVE-2026-97687"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283908 for CVE-2026-97687",
          "url": "https://bugzilla.suse.com/1283908"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-97687"
    },
    {
      "cve": "CVE-2026-97688",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-97688"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-97688",
          "url": "https://www.suse.com/security/cve/CVE-2026-97688"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283909 for CVE-2026-97688",
          "url": "https://bugzilla.suse.com/1283909"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-97688"
    },
    {
      "cve": "CVE-2026-97689",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-97689"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
          "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-97689",
          "url": "https://www.suse.com/security/cve/CVE-2026-97689"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283910 for CVE-2026-97689",
          "url": "https://bugzilla.suse.com/1283910"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-0:2.8.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-urllib3-0:2.8.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-97689"
    }
  ]
}