# CVE-2026-97689: urllib3 HTTP client unbounded memory allocation in chunked transfer

Source: https://junglewise.ai/threats/cve-2026-97689-urllib3-is-an-http-client-library-for-python-from-1-10-3-until-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-97689 · Severity: high · CVSS 4 · Published 2026-09-29

urllib3 is a Python HTTP client library used by many applications to communicate over the web. When a malicious or compromised server sends HTTP responses with improperly formatted chunked transfer encoding, urllib3 can allocate memory without limits, causing the client application to consume all available RAM and crash. This is a denial-of-service attack that can disrupt any Python application using urllib3.

Technologies: [urllib3 (PyPI)](https://junglewise.ai/threats/technologies/urllib3), [Urllib3](https://junglewise.ai/threats/technologies/urllib3-urllib3). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Urllib3](https://junglewise.ai/threats/vendors/urllib3).

## Quick answers

**Is CVE-2026-97689 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97689 being exploited in the wild.

**How severe is CVE-2026-97689?** High severity, with a CVSS score of 4, published 29 September 2026.

**Which products and versions are affected?** urllib3 (PyPI) >= 1.10.3, < 2.8.0, ECOSYSTEM:introduced=1.10.3,fixed=2.8.0; Urllib3 1.10.3 to 2.7.x (fixed in 2.8.0).

**Is there a fix for CVE-2026-97689?** Yes. urllib3 (PyPI): upgrade to 2.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97689 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-97689?** Check whether you run urllib3 (PyPI) or Urllib3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- urllib3 (PyPI): upgrade to 2.8.0 or later

  ```sh
  pip install "urllib3>=2.8.0"
  ```


## Technical details

The HTTPResponse.read_chunked() and HTTPResponse.stream() methods in urllib3 read the chunk-size line from a chunked transfer-encoding response without enforcing a length limit. A malicious HTTP server can exploit this by sending Transfer-Encoding: chunked followed by an unterminated chunk-size line (no newline), forcing the client to buffer the entire line in memory until EOF or newline detection, leading to unbounded memory exhaustion. The fix bounds the chunk-size line and trailing CRLF to http.client._MAXLINE, raising ProtocolError on overflow.

## Affected products

- urllib3 urllib3 1.10.3 to 2.7.x (fixed in 2.8.0)

## Identifiers

- CVE-2026-97689
- GHSA-vxq7-64xx-v4gw
- PYSEC-2026-4177

## Timeline

- 2026-09-29: disclosed
- 2026-09-15: patched: Fix released in version 2.8.0

## References

- [https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed](https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed)
- [https://github.com/urllib3/urllib3/releases/tag/2.8.0](https://github.com/urllib3/urllib3/releases/tag/2.8.0)

## Related threats

- [urllib3 infinite loop in Deflate decoder](https://junglewise.ai/threats/cve-2026-97688-urllib3-is-an-http-client-library-for-python-from-2-6-2-until-2-8)
- [urllib3 HTTPS proxy TLS settings isolation](https://junglewise.ai/threats/cve-2026-97687-urllib3-is-an-http-client-library-for-python-from-1-26-0-until-2)
- [PYSEC-2026-1997 - urllib3 does not control redirects in browsers and Node.js](https://junglewise.ai/threats/cve-2025-50182-urllib3-does-not-control-redirects-in-browsers-and-node-js)
- [PYSEC-2026-1999 - urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation](https://junglewise.ai/threats/cve-2025-50181-urllib3-redirects-are-not-disabled-when-retries-are-disabled-on)
- [PYSEC-2026-1995 - urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects](https://junglewise.ai/threats/cve-2024-37891-urllib3-proxy-authorization-header-leak-in-cross-origin-redirects)