VDB
RHSA-2026:85929
RHSA-2026:85929
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security (TLS) settings inadvertently overwrite the proxy's TLS configuration, which can disable certificate verification on reused connection contexts. Consequently, an attacker can impersonate the proxy to monitor or modify forwarded traffic or capture client credentials.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | python3.12-urllib3-0:1.26.19-3.el9_8.2.src as a component of Red Hat Enterprise Linux AppStream (v. 9) | 3.12-urllib3 |
| Red Hat | python3.12-urllib3-0:1.26.19-3.el9_8.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9) | 3.12-urllib3 |
Timeline
- Oct 20, 2026 CVE Published
- Oct 27, 2026 CVE Updated
- Oct 27, 2026 Distribution Patch
- Oct 27, 2026 Distribution Patch
- Oct 27, 2026 Security Advisory
- Oct 27, 2026 Security Advisory
- Oct 27, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:85929 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2543245 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2543255 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85929.json advisory
- https://access.redhat.com/security/cve/CVE-2026-97687 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-97687 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-97687 advisory
- https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465 advisory
- https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3 advisory
- https://github.com/urllib3/urllib3/pull/5093 advisory
- https://github.com/urllib3/urllib3/releases/tag/2.8.0 advisory
- https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77 advisory
- https://access.redhat.com/security/cve/CVE-2026-97689 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-97689 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-97689 advisory
- https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed advisory
- https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw advisory