VDB

GHSA-38jv-5279-wg99

GHSA-38jv-5279-wg99 PUBLISHED CVSS 7.5 HIGH

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Record from GitHub Advisory Database · Published January 7, 2026

urllib3 is fixed in 2.6.3 (PyPI)

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
urllib3PyPI2.6.3
tensorflow-cpu-jupyterWolfi2.21.0-r2
datadog-agent-fips-7.71Chainguard7.71.2-r10
dask-gatewayWolfi2025.4.0-r7
kubeflow-katibChainguard0.19.0-r14
py3-pipenvChainguard2026.6.0-r0
pgadmin4Chainguard9.12-r1
datadog-agent-7.77Wolfi7.77.3-r6
mlflowWolfi3.8.1-r1
jupyter-base-notebookChainguard7.5.2-r0
tensorflow-gpu-jupyterChainguard2.21.0-r2
open-webuiWolfi0.9.2-r0

86 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

VendorProductVersions
wolfitensorflow-cpu-jupyter0
chainguarddatadog-agent-fips-7.710
wolfidask-gateway0
chainguardkubeflow-katib0
chainguardpy3-pipenv0
chainguardpgadmin40
wolfidatadog-agent-7.770
wolfimlflow0
chainguardjupyter-base-notebook0
chainguardtensorflow-gpu-jupyter0
wolfiopen-webui0
chainguardmlflow0
chainguarddatadog-agent-7.760, 0
chainguardlabel-studio0
chainguardpypy-3.110
wolfikubeflow-katib0
wolfipy3-pip0
chainguardnemo0
chainguardauthentik0
chainguardawx0

…and 82 more

Timeline

  • Jan 7, 2026 CVE Published
  • Apr 9, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-38jv-5279-wg99
vulnetix vdb fixes GHSA-38jv-5279-wg99

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-38jv-5279-wg99/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›