VDB
RHSA-2026:84785
RHSA-2026:84785
PUBLISHED
CVSS 9.100000381469727 CRITICAL
A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security (TLS) settings inadvertently overwrite the proxy's TLS configuration, which can disable certificate verification on reused connection contexts. Consequently, an attacker can impersonate the proxy to monitor or modify forwarded traffic or capture client credentials.
Risk Scores
CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhtas/model-transparency-rhel9@sha256:0d6bce53b6e4e7cf1477789608338bb340362a8e8ee08898443995554443f0e4_arm64 as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/model-transparency-rhel9@sha256:a8b956060ce2e121ca025aac1eb0505fcd27649432b706e4a9a5ab4e9cd6c7a3_amd64 as a component of Red Hat Trusted Artifact Signer 1.4 | * |
Timeline
- Oct 19, 2026 CVE Published
- Oct 27, 2026 CVE Updated
- Oct 27, 2026 Distribution Patch
- Oct 27, 2026 Distribution Patch
- Oct 27, 2026 Security Advisory
- Oct 27, 2026 Security Advisory
- Oct 27, 2026 Security Advisory
- Oct 27, 2026 Security Advisory
- Oct 27, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:84785 advisory
- https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4 advisory
- https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index advisory
- https://access.redhat.com/security/cve/CVE-2026-102267 advisory
- https://access.redhat.com/security/cve/CVE-2026-102268 advisory
- https://access.redhat.com/security/cve/CVE-2026-97687 advisory
- https://access.redhat.com/security/cve/CVE-2026-97689 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84785.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2543255 issue
- https://www.cve.org/CVERecord?id=CVE-2026-97687 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-97687 advisory
- https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465 advisory
- https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3 advisory
- https://github.com/urllib3/urllib3/pull/5093 advisory
- https://github.com/urllib3/urllib3/releases/tag/2.8.0 advisory
- https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2543245 issue
- https://www.cve.org/CVERecord?id=CVE-2026-97689 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-97689 advisory
…and 13 more