Quick answers
- Is CVE-2026-97689 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-97689 being exploited in the wild.
- How severe is CVE-2026-97689?
- High severity, with a CVSS score of 4, published 29 September 2026.
- Which products and versions are affected?
- urllib3 (PyPI) >= 1.10.3, < 2.8.0, ECOSYSTEM:introduced=1.10.3,fixed=2.8.0; Urllib3 1.10.3 to 2.7.x (fixed in 2.8.0).
- Is there a fix for CVE-2026-97689?
- Yes. urllib3 (PyPI): upgrade to 2.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-97689 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-97689?
- Check whether you run urllib3 (PyPI) or Urllib3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- urllib3 (PyPI): upgrade to 2.8.0 or later
pip install "urllib3>=2.8.0"
Technical details
The HTTPResponse.read_chunked() and HTTPResponse.stream() methods in urllib3 read the chunk-size line from a chunked transfer-encoding response without enforcing a length limit. A malicious HTTP server can exploit this by sending Transfer-Encoding: chunked followed by an unterminated chunk-size line (no newline), forcing the client to buffer the entire line in memory until EOF or newline detection, leading to unbounded memory exhaustion. The fix bounds the chunk-size line and trailing CRLF to http.client._MAXLINE, raising ProtocolError on overflow.
Affected products
- urllib3 urllib3 1.10.3 to 2.7.x (fixed in 2.8.0)
Identifiers
- CVE-2026-97689
- GHSA-vxq7-64xx-v4gw
- PYSEC-2026-4177
Timeline
- 2026-09-29: disclosed
- 2026-09-15: patched: Fix released in version 2.8.0