Ubuntu alert USN-7927-1 (python-urllib3)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7927-1] urllib3 vulnerabilities
Date:
             
 
Thu, 11 Dec 2025 17:39:24 +0000
Message-ID:
             
 
<E1vTkdQ-00018K-H2@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-7927-1
December 11, 2025

python-urllib3 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.10
- Ubuntu 25.04
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in urllib3.

Software Description:
- python-urllib3: HTTP library with thread-safe connection pooling

Details:

Illia Volochii discovered that urllib3 did not limit the steps in a
decompression chain. An attacker could possibly use this issue to cause
urllib3 to use excessive resources, causing a denial of service.
(CVE-2025-66418)

Rui Xi discovered that urllib3 incorrectly handled highly compressed data.
An attacker could possibly use this issue to cause urllib3 to use excessive
resources, causing a denial of service. This issue only affected Ubuntu
24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-66471)

For the brotli encoding, the fix for CVE-2025-66471 requires an additional
security update in the brotli package.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
  python3-urllib3                 2.3.0-3ubuntu0.1

Ubuntu 25.04
  python3-urllib3                 2.3.0-2ubuntu0.2

Ubuntu 24.04 LTS
  python3-urllib3                 2.0.7-1ubuntu0.3

Ubuntu 22.04 LTS
  python3-urllib3                 1.26.5-1~exp1ubuntu0.4

Ubuntu 20.04 LTS
  python3-urllib3                 1.25.8-2ubuntu0.4+esm2
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7927-1
  CVE-2025-66418, CVE-2025-66471

Package Information:
  https://launchpad.net/ubuntu/+source/python-urllib3/2.3.0...
  https://launchpad.net/ubuntu/+source/python-urllib3/2.3.0...
  https://launchpad.net/ubuntu/+source/python-urllib3/2.0.7...
  https://launchpad.net/ubuntu/+source/python-urllib3/1.26....


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmk7AKkACgkQcpJm3tlz
hgFTvA//bPNr/9KAsgsnjEQ1HEi+DpTszt5BVnetTpzGcKbWYxS2rohM0hpYZNtC
oQgFaa0FpK0BiQDt9ZMd8rIQM6BdLiLz8XQ5kv0TrIFCQZXLbeNxJFJ4GjnllJwv
7rfS1/1OfqVj1GaUkl3tj6ecNZ+02KozkVg2oGqEUf+Qw/NYDbAeMu6G0nwjS6Gt
GKphDZFtYiWVAGHktQXdFatRG4VRRL1NTn0H4LWV9mSDHmX2y02I4h89qm77tMe8
2sKpQPIf4RGnG6zBo8buDgmk5yWzOgaggoZs9rRoaVjmw400GKN2Z8LodlrOSixy
6WZjZscY1G6U22qW2bpt38WkExfbhlBWejdOVEuVtys+Pai34Nm1E2HQuN7NypaE
EBbDKmvcPnxnO46Fls1xUJHsjj9lumwwqE3FdEXzVoXDF4KgSOw8kKpingOzAOPj
/Zf1LljowQYKCcE9btN1dzfkMnnNE3RXxY6waGzcbhq//D840UVk1/FFh8RdKfv8
EDl4r5CO/f5SiFUpD4NfG1/dWtrLSnCtNqQ2ngGuGC5iPy5rcsGizjw8f+FQruw+
JycvDmkDsK8bP7EpEdyxSAXQE0gfKkhILfdiMQ3IyXbQSAgs3g6r+jtiw3b6JRUR
D2Se26BLS+As3FagzjBQtkaIv/bO6L+IvvaT0awjMmG4cq/DZzo=
=E7vt
-----END PGP SIGNATURE-----