Read the docs
TI-2026-32372 Aliases CVE-2026-44431GHSA-qccp-gfcp-xxvc

urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

Priority LOW 36CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 47 fixed, 14 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00331 26th percentileScored 2026-11-07
Fix Partial urllib3 (urllib3): 2.7.0urllib3 (PyPI): 2.7.0Red Hat: 88 advisoriesRed Hat: 47 fixed, 14 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
python-pillowurllib31.23 to before 2.7.02.7.0Patch availableCNA
—urllib3 (PyPI)1.23 to before 2.7.02.7.0Patch availableGHSA-qccp-gfcp-xxvc
  • urllib3 Vendorpython-pillow Affected 1.23 to before 2.7.0 Fixed in 2.7.0 Patch available CNA
  • urllib3 (PyPI) Vendor— Affected 1.23 to before 2.7.0 Fixed in 2.7.0 Patch available GHSA-qccp-gfcp-xxvc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*1.23 to before 2.7.0Vulnerablepython-pillow
  • cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* Versions 1.23 to before 2.7.0 Vulnerable ·python-pillow

Remediation

  • Fix · CNA urllib3 (urllib3) Fixed in 2.7.0
  • Fix · GHSA-qccp-gfcp-xxvc urllib3 (PyPI) Fixed in 2.7.0 Advisory →

Red Hat 88 advisories

  • RHSA-2026:92281 Released 2026-11-04 · Red Hat rating Important
    OpenShift Container Platform 4.19.54 security and extras update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9-operator
  • RHSA-2026:92284 Released 2026-11-03 · Red Hat rating Important
    OpenShift Container Platform 4.20.45 security and extras update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9-operator, registry.redhat.io/openshift4/ose-ptp-rhel9-operator
  • RHSA-2026:92452 Released 2026-10-29 · Red Hat rating Critical
    Red Hat Enterprise Linux AI 3.5.2 enhancement update
    • Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
Show 85 more Red Hat advisories
  • RHSA-2026:92449 Released 2026-10-29 · Red Hat rating Critical
    Red Hat Enterprise Linux AI 3.5.2 enhancement update
    • Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:83703 Released 2026-10-20 · Red Hat rating Important
    OpenShift Container Platform 4.21.39 security and extras update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-cluster-capacity-rhel9 +6
  • RHSA-2026:82415 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (cpu)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:82371 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (spyre)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-spyre-rhel9
  • RHSA-2026:82368 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (cuda)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:82066 Released 2026-10-13 · Red Hat rating Important
    Red Hat AI Inference Model Optimization Tools 3.5.2 (CUDA)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/model-opt-cuda-rhel9
  • RHSA-2026:82061 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference Tech Preview 3.5.2 (Gaudi)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-gaudi-rhel9
  • RHSA-2026:82059 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (ROCm)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-rocm-rhel9
  • RHSA-2026:74674 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:74463 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (ROCm 7.0)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:74462 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (CUDA 12.9)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:74461 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (Spyre)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:74460 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (CPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:74459 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (ROCm 6.4)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:74458 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (TPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:73962 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (cuda)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:73961 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (spyre)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:73960 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (cpu)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:73959 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (tpu)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:73930 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (rocm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:73929 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (cuda)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:73909 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (rocm)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:73859 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
    RHOAI 2.25.11 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:60371 Released 2026-08-26 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.4) python-urllib3-1.26.5-5.el9_4.4, python3-urllib3-1.26.5-5.el9_4.4
  • RHSA-2026:60362 Released 2026-08-26 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) python-urllib3-1.26.5-3.el9_2.4, python3-urllib3-1.26.5-3.el9_2.4
  • RHSA-2026:59409 Released 2026-08-25 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) python-urllib3-1.26.5-6.el9_6.2, python3-urllib3-1.26.5-6.el9_6.2
  • RHSA-2026:58981 Released 2026-08-24 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.3 Technology Preview security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-tp-rhel9, registry.redhat.io/rhui5/installer-tp-rhel9, registry.redhat.io/rhui5/rhua-tp-rhel9
  • RHSA-2026:56347 Released 2026-08-18 · Red Hat rating Important
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-analyzer-addon-rhel9, registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-discovery-addon-rhel9 +4
  • RHSA-2026:47126 Released 2026-08-12 · Red Hat rating Moderate
    resource-agents security update
    • Red Hat Enterprise Linux HighAvailability (v. 8) resource-agents-4.9.0-54.el8_10.36, resource-agents-aliyun-4.9.0-54.el8_10.36, resource-agents-gcp-4.9.0-54.el8_10.36 +1
    • Red Hat Enterprise Linux ResilientStorage (v. 8) resource-agents-4.9.0-54.el8_10.36, resource-agents-aliyun-4.9.0-54.el8_10.36, resource-agents-gcp-4.9.0-54.el8_10.36 +1
  • RHSA-2026:47129 Released 2026-08-12 · Red Hat rating Moderate
    resource-agents security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.8) resource-agents-4.9.0-40.el8_8.20, resource-agents-aliyun-4.9.0-40.el8_8.20, resource-agents-gcp-4.9.0-40.el8_8.20 +1
    • Red Hat Enterprise Linux High Availability TUS (v.8.8) resource-agents-4.9.0-40.el8_8.20, resource-agents-aliyun-4.9.0-40.el8_8.20, resource-agents-gcp-4.9.0-40.el8_8.20 +1
  • RHSA-2026:51357 Released 2026-08-06 · Red Hat rating Important
    satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
  • RHSA-2026:51356 Released 2026-08-06 · Red Hat rating Moderate
    General availability of the satellite/iop-advisor-backend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-advisor-backend-rhel9
  • RHSA-2026:51206 Released 2026-08-06 · Red Hat rating Important
    General availability of the satellite/iop-advisor-backend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-advisor-backend-rhel9
  • RHSA-2026:51157 Released 2026-08-06 · Red Hat rating Moderate
    fence-agents security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) fence-agents-4.2.1-89.el8_6.25, fence-agents-all-4.2.1-89.el8_6.25, fence-agents-amt-ws-4.2.1-89.el8_6.25 +40
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) fence-agents-4.2.1-89.el8_6.25, fence-agents-all-4.2.1-89.el8_6.25, fence-agents-amt-ws-4.2.1-89.el8_6.25 +40
    • Red Hat Enterprise Linux High Availability EUS EXTENSION (v.8.6) fence-agents-aliyun-4.2.1-89.el8_6.25, fence-agents-aws-4.2.1-89.el8_6.25, fence-agents-azure-arm-4.2.1-89.el8_6.25 +1
  • RHSA-2026:51152 Released 2026-08-06 · Red Hat rating Moderate
    fence-agents security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) fence-agents-4.2.1-65.el8_4.31, fence-agents-all-4.2.1-65.el8_4.31, fence-agents-amt-ws-4.2.1-65.el8_4.31 +40
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) fence-agents-4.2.1-65.el8_4.31, fence-agents-all-4.2.1-65.el8_4.31, fence-agents-amt-ws-4.2.1-65.el8_4.31 +36
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.31, fence-agents-aws-4.2.1-65.el8_4.31, fence-agents-azure-arm-4.2.1-65.el8_4.31 +1
    • Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.31, fence-agents-aws-4.2.1-65.el8_4.31, fence-agents-azure-arm-4.2.1-65.el8_4.31 +1
  • RHSA-2026:51045 Released 2026-08-06 · Red Hat rating Moderate
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) fence-agents-4.2.1-112.el8_8.20, fence-agents-all-4.2.1-112.el8_8.20, fence-agents-amt-ws-4.2.1-112.el8_8.20 +40
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) fence-agents-4.2.1-112.el8_8.20, fence-agents-all-4.2.1-112.el8_8.20, fence-agents-amt-ws-4.2.1-112.el8_8.20 +39
    • Red Hat Enterprise Linux High Availability E4S (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.20, fence-agents-aws-4.2.1-112.el8_8.20, fence-agents-azure-arm-4.2.1-112.el8_8.20 +2
    • Red Hat Enterprise Linux High Availability TUS (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.20, fence-agents-aws-4.2.1-112.el8_8.20, fence-agents-azure-arm-4.2.1-112.el8_8.20 +2
  • RHSA-2026:49927 Released 2026-08-04 · Red Hat rating Moderate
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 8) fence-agents-4.2.1-129.el8_10.28, fence-agents-all-4.2.1-129.el8_10.28, fence-agents-amt-ws-4.2.1-129.el8_10.28 +41
    • Red Hat Enterprise Linux HighAvailability (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.28, fence-agents-aws-4.2.1-129.el8_10.28, fence-agents-azure-arm-4.2.1-129.el8_10.28 +2
    • Red Hat Enterprise Linux ResilientStorage (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.28, fence-agents-aws-4.2.1-129.el8_10.28, fence-agents-azure-arm-4.2.1-129.el8_10.28 +2
  • RHSA-2026:47091 Released 2026-07-28 · Red Hat rating Moderate
    resource-agents security update
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) resource-agents-4.1.1-90.el8_4.26, resource-agents-aliyun-4.1.1-90.el8_4.26, resource-agents-gcp-4.1.1-90.el8_4.26
    • Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) resource-agents-4.1.1-90.el8_4.26, resource-agents-aliyun-4.1.1-90.el8_4.26, resource-agents-gcp-4.1.1-90.el8_4.26
  • RHSA-2026:47092 Released 2026-07-28 · Red Hat rating Moderate
    resource-agents security update
    • Red Hat Enterprise Linux High Availability EUS EXTENSION (v.8.6) resource-agents-4.9.0-16.el8_6.23, resource-agents-aliyun-4.9.0-16.el8_6.23, resource-agents-gcp-4.9.0-16.el8_6.23 +1
  • RHSA-2026:44696 Released 2026-07-23 · Red Hat rating Important
    satellite/iop-advisor-engine-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.17 registry.redhat.io/satellite/iop-advisor-engine-rhel9
  • RHSA-2026:44481 Released 2026-07-23 · Red Hat rating Important
    Red Hat Update Infrastructure 5.2 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:43038 Released 2026-07-21 · Red Hat rating Critical
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-solution-server-rhel9
  • RHSA-2026:42644 Released 2026-07-21 · Red Hat rating Important
    RHOAI 2.25.9 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-feature-server-rhel9, registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9 +36
  • RHSA-2026:42144 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8 +1
  • RHSA-2026:42132 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
  • RHSA-2026:37275 Released 2026-07-09 · Red Hat rating Critical
    RHOAI 3.3.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9, registry.redhat.io/rhoai/odh-feast-operator-rhel9 +45
  • RHSA-2026:37094 Released 2026-07-09 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images mariadb-3:11.8.8-3.hum1@aarch64, mariadb-3:11.8.8-3.hum1@x86_64, mariadb-backup-3:11.8.8-3.hum1@aarch64 +37
  • RHSA-2026:36732 Released 2026-07-08 · Red Hat rating Moderate
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS (v. 8) python-urllib3-1.24.2-10.el8_10, python3-urllib3-1.24.2-10.el8_10
  • RHSA-2026:36350 Released 2026-07-07 · Red Hat rating Important
    satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/foreman-mcp-server-rhel9
  • RHSA-2026:34607 Released 2026-07-01 · Red Hat rating Important
    General availability of the satellite/iop-insights-engine-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-insights-engine-rhel9
  • RHSA-2026:34533 Released 2026-07-01 · Red Hat rating Important
    General availability of the satellite/iop-yuptoo-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-yuptoo-rhel9
  • RHSA-2026:34532 Released 2026-07-01 · Red Hat rating Moderate
    General availability of the satellite/iop-host-inventory-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-host-inventory-rhel9
  • RHSA-2026:34531 Released 2026-07-01 · Red Hat rating Important
    General availability of the satellite/iop-puptoo-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-puptoo-rhel9
  • RHSA-2026:34526 Released 2026-07-01 · Red Hat rating Important
    Technical preview of the satellite/iop-vmaas-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vmaas-rhel9
  • RHSA-2026:34374 Released 2026-07-01 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +5
  • RHSA-2026:34160 Released 2026-07-01 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.13-2.el9ap, automation-controller-cli-4.7.13-2.el9ap, automation-controller-server-4.7.13-2.el9ap +7
  • RHSA-2026:34119 Released 2026-07-01 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python-rpds-py-2026.6.3-1.hum1@src, python3-rpds-py-2026.6.3-1.hum1@aarch64, python3-rpds-py-2026.6.3-1.hum1@x86_64
  • RHSA-2026:33313 Released 2026-06-29 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:32992 Released 2026-06-29 · Red Hat rating Important
    python3.12-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.12-urllib3-1.26.19-3.el8_10
  • RHSA-2026:30169 Released 2026-06-25 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python-sentry-sdk-2.48.0-6.hum1@src, python3-sentry-sdk+aiohttp-2.48.0-6.hum1@noarch@public-hummingbird-aarch64-rpms, python3-sentry-sdk+aiohttp-2.48.0-6.hum1@noarch@public-hummingbird-x86_64-rpms +34
  • RHSA-2026:30089 Released 2026-06-25 · Red Hat rating Critical
    Red Hat AI Inference Server 3.3.5 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:30088 Released 2026-06-25 · Red Hat rating Critical
    Red Hat AI Inference Server 3.3.5 (ROCm)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:30087 Released 2026-06-25 · Red Hat rating Critical
    Red Hat AI Inference Server 3.3.5 (Spyre)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-spyre-rhel9
  • RHSA-2026:30078 Released 2026-06-25 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.3.5 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:28157 Released 2026-06-23 · Red Hat rating Important
    python3.14-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.14-urllib3-2.6.3-2.el9_8
  • RHSA-2026:28159 Released 2026-06-23 · Red Hat rating Important
    python3.12-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.12-urllib3-1.26.19-3.el9_8
  • RHSA-2026:28158 Released 2026-06-23 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS (v. 9) python-urllib3-1.26.5-8.el9_8, python3-urllib3-1.26.5-8.el9_8
  • RHSA-2026:28000 Released 2026-06-22 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS (v. 10) python-urllib3-1.26.19-4.el10_2, python3-urllib3-1.26.19-4.el10_2
  • RHSA-2026:27929 Released 2026-06-22 · Red Hat rating Important
    python3.14-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 10) python3.14-urllib3-2.6.3-2.el10_2
  • RHSA-2026:26304 Released 2026-06-16 · Red Hat rating Important
    General availability of the satellite/iop-insights-engine-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-insights-engine-rhel9
  • RHSA-2026:26226 Released 2026-06-16 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-rhel9
  • RHSA-2026:26221 Released 2026-06-16 · Red Hat rating Moderate
    Technical preview of the satellite/iop-vmaas-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vmaas-rhel9
  • RHSA-2026:26215 Released 2026-06-16 · Red Hat rating Moderate
    General availability of the satellite/iop-yuptoo-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-yuptoo-rhel9
  • RHSA-2026:26212 Released 2026-06-16 · Red Hat rating Important
    General availability of the satellite/iop-puptoo-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-puptoo-rhel9
  • RHSA-2026:25928 Released 2026-06-15 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-27/hub-rhel9 +3
  • RHSA-2026:25039 Released 2026-06-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images jaeger-2.19.0-1.hum1@aarch64, jaeger-2.19.0-1.hum1@src, jaeger-2.19.0-1.hum1@x86_64
  • RHSA-2026:24544 Released 2026-06-08 · Red Hat rating Important
    Red Hat AI Inference 3.4.1 (cuda)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:24542 Released 2026-06-08 · Red Hat rating Important
    Red Hat AI Inference Model Optimization Tools 3.4.1 (cuda)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/model-opt-cuda-rhel9
  • RHSA-2026:24541 Released 2026-06-08 · Red Hat rating Important
    Red Hat AI Inference 3.4.1 (spyre)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-spyre-rhel9
  • RHSA-2026:24540 Released 2026-06-08 · Red Hat rating Important
    Red Hat AI Inference 3.4.1 (cpu)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:24483 Released 2026-06-08 · Red Hat rating Important
    RHTAS 1.4 - GA Release of Model Transparency 1.0.1
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/model-transparency-rhel9
  • RHSA-2026:24009 Released 2026-06-07 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python-urllib3-2.7.0-3.hum1@src, python3-urllib3+brotli-2.7.0-3.hum1@noarch@public-hummingbird-aarch64-rpms, python3-urllib3+brotli-2.7.0-3.hum1@noarch@public-hummingbird-x86_64-rpms +8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix planned: Out of support scope
Migration Toolkit for ContainersAffectedNo fix yet
Migration Toolkit for VirtualizationAffectedNo fix yet: Fix deferred
OpenShift LightspeedAffectedNo fix yet
Pen Drive Powered by Red Hat LightspeedAffectedNo fix planned: Will not fix
Red Hat AI Inference ServerAffectedNo fix planned: Will not fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Developer Hub 1AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix planned: Out of support scope
Red Hat Quay 3AffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix planned: Out of support scope
Red Hat AI Inference Server 3.2Fixed RHSA-2026:73859, RHSA-2026:73929, RHSA-2026:73930
Red Hat AI Inference Server 3.3Fixed RHSA-2026:30078, RHSA-2026:30087, RHSA-2026:30088, RHSA-2026:30089
Red Hat AI Inference Server 3.4Fixed RHSA-2026:24540, RHSA-2026:24541, RHSA-2026:24542, RHSA-2026:24544
Red Hat AI Inference Server 3.5Fixed RHSA-2026:82059, RHSA-2026:82061, RHSA-2026:82066, RHSA-2026:82368, RHSA-2026:82371, RHSA-2026:82415
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:42144
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:34374, RHSA-2026:42132
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:34160
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:25928
Red Hat Discovery 2Fixed RHSA-2026:33313
Red Hat Enterprise Linux AI 3.5Fixed RHSA-2026:92449, RHSA-2026:92452
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:27929
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:32992, RHSA-2026:49927
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:28157, RHSA-2026:28159
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:51152
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:51157
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:51045
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:51152
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:51157
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:51045
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:28000
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:36732
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:28158
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:60362
Red Hat Enterprise Linux BaseOS E4S (v.9.4)Fixed RHSA-2026:60371
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:59409
Red Hat Enterprise Linux High Availability AUS (v.8.4)Fixed RHSA-2026:47091, RHSA-2026:51152
Red Hat Enterprise Linux High Availability E4S (v.8.8)Fixed RHSA-2026:47129, RHSA-2026:51045
Red Hat Enterprise Linux High Availability EUS EXTENSION (v.8.6)Fixed RHSA-2026:47092, RHSA-2026:51157
Red Hat Enterprise Linux High Availability TUS (v.8.8)Fixed RHSA-2026:47129, RHSA-2026:51045
Red Hat Enterprise Linux HighAvailability (v. 8)Fixed RHSA-2026:47126, RHSA-2026:49927
Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4)Fixed RHSA-2026:47091, RHSA-2026:51152
Red Hat Enterprise Linux ResilientStorage (v. 8)Fixed RHSA-2026:47126, RHSA-2026:49927
Red Hat Hardened ImagesFixed RHSA-2026:24009, RHSA-2026:25039, RHSA-2026:30169, RHSA-2026:34119, RHSA-2026:37094
Red Hat Migration Toolkit for Applications 8.2Fixed RHSA-2026:43038, RHSA-2026:56347
Red Hat OpenShift AI 2.25Fixed RHSA-2026:42644, RHSA-2026:65126, RHSA-2026:87410
Red Hat OpenShift AI 3.0Fixed RHSA-2026:73909, RHSA-2026:73959, RHSA-2026:73960, RHSA-2026:73961, RHSA-2026:73962
Red Hat OpenShift AI 3.2Fixed RHSA-2026:74458, RHSA-2026:74459, RHSA-2026:74460, RHSA-2026:74461, RHSA-2026:74462, RHSA-2026:74463
Red Hat OpenShift AI 3.3Fixed RHSA-2026:37275, RHSA-2026:73987
Red Hat OpenShift AI 3.4Fixed RHSA-2026:74674
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:92281
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:92284
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:83703
Red Hat Satellite 6.17Fixed RHSA-2026:44696
Red Hat Satellite 6.18Fixed RHSA-2026:26212, RHSA-2026:26215, RHSA-2026:26221, RHSA-2026:26226, RHSA-2026:26304, RHSA-2026:36350, RHSA-2026:51356, RHSA-2026:51357
Red Hat Satellite 6.19Fixed RHSA-2026:34526, RHSA-2026:34531, RHSA-2026:34532, RHSA-2026:34533, RHSA-2026:34607, RHSA-2026:51206
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:24483
Red Hat Update Infrastructure 5Fixed RHSA-2026:44481, RHSA-2026:58981
Not affected: 29 products
  • External Secrets Operator for Red Hat OpenShift
  • OpenShift Lightspeed
  • OpenShift Service Mesh 3
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat Migration Toolkit for Applications 8.2
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenStack Platform 17.1
  • Red Hat Satellite 6
  • Red Hat Update Infrastructure 4 for Cloud Providers
  • Red Hat Update Infrastructure 5
  • Red Hat build of Quarkus Native builder
  • Service Telemetry Framework 1.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44431
  2. 2026-10-03 Alias added: GHSA-qccp-gfcp-xxvc
  3. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  4. 2026-10-13 Fix available: RHSA-2026:82066 · Red Hat
  5. 2026-10-13 Fix available: RHSA-2026:82061 · Red Hat
  6. 2026-10-13 Fix available: RHSA-2026:82059 · Red Hat
  7. 2026-10-13 Fix available: Red Hat AI Inference Server 3.5 · Red Hat
  8. 2026-10-14 Fix available: RHSA-2026:82368 · Red Hat
  9. 2026-10-14 Fix available: RHSA-2026:82415 · Red Hat
  10. 2026-10-14 Fix available: RHSA-2026:82371 · Red Hat
  11. 2026-10-15 Affected versions changed · Red Hat
  12. 2026-10-16 Affected versions changed · Red Hat
  13. 2026-10-20 Fix available: RHSA-2026:83703 · Red Hat
  14. 2026-10-21 Fix available: Red Hat OpenShift Container Platform 4.21 · Red Hat
  15. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  16. 2026-10-23 Affected versions changed · Red Hat
  17. 2026-10-27 Affected versions changed · Red Hat
  18. 2026-10-30 Fix available: RHSA-2026:92452 · Red Hat
  19. 2026-10-30 Fix available: RHSA-2026:92449 · Red Hat
  20. 2026-10-30 Fix available: Red Hat Enterprise Linux AI 3.5 · Red Hat
  21. 2026-11-03 Fix available: RHSA-2026:92284 · Red Hat
  22. 2026-11-03 Fix available: Red Hat OpenShift Container Platform 4.20 · Red Hat
  23. 2026-11-04 Fix available: RHSA-2026:92281 · Red Hat
  24. 2026-11-04 Fix available: Red Hat OpenShift Container Platform 4.19 · Red Hat
  25. 2026-11-06 Fix available: RHSA-2026:42644 · Red Hat

References

Advisory 2

Other 1

  • TI-2026-17326 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVSS 4.0HIGH 8.9
  • TI-2018-14221 urllib3 before version 1.23 does not remove the Authorization HTTP header when following… CVSS 3.0CRITICAL 9.8
  • TI-2025-40854 urllib3 allows an unbounded number of links in the decompression chain CVSS 4.0HIGH 8.9
  • TI-2026-32373 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API CVSS 4.0HIGH 8.9
  • TI-2025-40898 urllib3 Streaming API improperly handles highly compressed data CVSS 4.0HIGH 8.9
  • TI-2021-12905 An issue was discovered in urllib3 before 1.26.5. CVSS 3.1HIGH 7.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences