urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 25 fixed, 19 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| python-pillow | urllib3 | 1.10.3 to before 2.8.0 | 2.8.0 | Patch available | CNA |
| — | urllib3 (PyPI) | 1.10.3 to before 2.8.0 | 2.8.0 | Patch available | GHSA-vxq7-64xx-v4gw |
- urllib3 Vendorpython-pillow Affected 1.10.3 to before 2.8.0 Fixed in 2.8.0 Patch available CNA
- urllib3 (PyPI) Vendor— Affected 1.10.3 to before 2.8.0 Fixed in 2.8.0 Patch available GHSA-vxq7-64xx-v4gw
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* | 1.10.3 to before 2.8.0 | Vulnerable | python-pillow |
- cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* Versions 1.10.3 to before 2.8.0 Vulnerable ·python-pillow
Remediation
- Fix · CNA urllib3 (urllib3) Fixed in 2.8.0
- Fix · GHSA-vxq7-64xx-v4gw urllib3 (PyPI) Fixed in 2.8.0 Advisory →
Red Hat 35 advisories
- RHSA-2026:95655 Released 2026-11-05 · Red Hat rating CriticalSatellite 6.16 EUS security update
- Red Hat Satellite 6.16 for RHEL 8 openvox-agent-8.32.0-1.el8sat, openvox-server-8.18.0-1.el8sat, python-brotli-1.2.1-1.el8pc +11
- Red Hat Satellite 6.16 for RHEL 9 openvox-agent-8.32.0-1.el9sat, openvox-server-8.18.0-1.el9sat, python-brotli-1.2.1-1.el9pc +11
- RHSA-2026:95657 Released 2026-11-05 · Red Hat rating CriticalSatellite 6.18 security update
- Red Hat Satellite 6.18 for RHEL 9 openvox-agent-8.32.0-1.el9sat, openvox-server-8.18.0-1.el9sat, python3.12-brotli-1.2.1-1.el9pc +4
- RHSA-2026:95656 Released 2026-11-05 · Red Hat rating CriticalSatellite 6.17 security update
- Red Hat Satellite 6.17 for RHEL 9 openvox-agent-8.32.0-1.el9sat, openvox-server-8.18.0-1.el9sat, python-brotli-1.2.1-1.el9pc +9
Show 32 more Red Hat advisories
- RHSA-2026:95365 Released 2026-11-04 · Red Hat rating CriticalRed Hat Cost Management On-Premise container image update
- Red Hat Cost Management On-Premise 1 registry.redhat.io/costmanagement/costmanagement-ui-rhel10
- RHSA-2026:95267 Released 2026-11-04 · Red Hat rating CriticalRHTAS 1.5.1 - Tech Preview Release Of the Sigstore A2A 0.0.2
- Red Hat Trusted Artifact Signer 1.5 registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9
- RHSA-2026:94802 Released 2026-11-04 · Red Hat rating CriticalA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:85930 Released 2026-11-02 · Red Hat rating Importantpython-urllib3 security update
- Red Hat Enterprise Linux BaseOS (v. 10) python-urllib3-1.26.19-4.el10_2.2, python3-urllib3-1.26.19-4.el10_2.2
- RHSA-2026:92861 Released 2026-10-29 · Red Hat rating CriticalSatellite 6.19 security update
- Red Hat Satellite 6.19 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, python3.12-brotli-1.2.1-1.el9pc +6
- RHSA-2026:92667 Released 2026-10-29 · Red Hat rating Criticalsatellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
- Red Hat Satellite 6.18 registry.redhat.io/satellite/foreman-mcp-server-rhel9
- RHSA-2026:92666 Released 2026-10-29 · Red Hat rating Criticalsatellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
- Red Hat Satellite 6.19 registry.redhat.io/satellite/foreman-mcp-server-rhel9
- RHSA-2026:92474 Released 2026-10-29 · Red Hat rating Importantpython3.12-urllib3 security update
- Red Hat Enterprise Linux AppStream (v. 8) python3.12-urllib3-1.26.19-5.el8_10
- RHSA-2026:92510 Released 2026-10-29 · Red Hat rating CriticalRHOAI 3.4.6 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:92452 Released 2026-10-29 · Red Hat rating CriticalRed Hat Enterprise Linux AI 3.5.2 enhancement update
- Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
- RHSA-2026:92449 Released 2026-10-29 · Red Hat rating CriticalRed Hat Enterprise Linux AI 3.5.2 enhancement update
- Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
- RHSA-2026:90759 Released 2026-10-27 · Red Hat rating Importantpython-urllib3 security update
- Red Hat Enterprise Linux BaseOS (v. 8) python-urllib3-1.24.2-11.el8_10, python3-urllib3-1.24.2-11.el8_10
- RHSA-2026:90494 Released 2026-10-26 · Red Hat rating Importantpython-urllib3 security update
- Red Hat Enterprise Linux BaseOS (v. 9) python-urllib3-1.26.5-8.el9_8.2, python3-urllib3-1.26.5-8.el9_8.2
- RHSA-2026:90440 Released 2026-10-26 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.4.6 security update
- Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
- RHSA-2026:90432 Released 2026-10-26 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.4.6 security update
- Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
- RHSA-2026:87124 Released 2026-10-21 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9 +8
- RHSA-2026:87120 Released 2026-10-21 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-26/gateway-rhel9 +8
- RHSA-2026:85929 Released 2026-10-20 · Red Hat rating Importantpython3.12-urllib3 security update
- Red Hat Enterprise Linux AppStream (v. 9) python3.12-urllib3-1.26.19-3.el9_8.2
- RHSA-2026:84785 Released 2026-10-19 · Red Hat rating CriticalRHTAS 1.4.4 - Release of Model Transparency 1.0.5
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/model-transparency-rhel9
- RHSA-2026:84577 Released 2026-10-19 · Red Hat rating Importantpython3.14-urllib3 security update
- Red Hat Enterprise Linux AppStream (v. 9) python3.14-urllib3-2.6.3-2.el9_8.6
- RHSA-2026:84578 Released 2026-10-19 · Red Hat rating Importantpython3.14-urllib3 security update
- Red Hat Enterprise Linux AppStream (v. 10) python3.14-urllib3-2.6.3-2.el10_2.6
- RHSA-2026:83121 Released 2026-10-14 · Red Hat rating ImportantRed Hat AI Inference 3.4.6 (rocm)
- Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-rocm-rhel9
- RHSA-2026:83120 Released 2026-10-14 · Red Hat rating ImportantRed Hat AI Inference 3.4.6 (cuda)
- Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cuda-rhel9
- RHSA-2026:83116 Released 2026-10-14 · Red Hat rating ImportantRed Hat AI Inference Model Optimization Tools 3.4.6 (cuda)
- Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/model-opt-cuda-rhel9
- RHSA-2026:83114 Released 2026-10-14 · Red Hat rating ImportantRed Hat AI Inference 3.4.6 (spyre)
- Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-spyre-rhel9
- RHSA-2026:83112 Released 2026-10-14 · Red Hat rating ImportantRed Hat AI Inference 3.4.6 (cpu)
- Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cpu-rhel9
- RHSA-2026:82415 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (cpu)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cpu-rhel9
- RHSA-2026:82371 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (spyre)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-spyre-rhel9
- RHSA-2026:82368 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (cuda)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cuda-rhel9
- RHSA-2026:82061 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference Tech Preview 3.5.2 (Gaudi)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-gaudi-rhel9
- RHSA-2026:82059 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (ROCm)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-rocm-rhel9
- RHSA-2026:69612 Released 2026-09-21 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images python-urllib3-2.8.0-1.hum1@src, python3-urllib3+brotli-2.8.0-1.hum1@noarch@public-hummingbird-aarch64-rpms, python3-urllib3+brotli-2.8.0-1.hum1@noarch@public-hummingbird-x86_64-rpms +8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Ansible Automation Orchestrator 2026 | Affected | No fix yet |
| Exploit Intelligence | Affected | — |
| Lightspeed Core | Affected | No fix yet |
| Migration Toolkit for Applications 8 | Affected | No fix yet |
| Migration Toolkit for Containers | Affected | No fix yet |
| Migration Toolkit for Virtualization | Affected | No fix yet |
| OpenShift Lightspeed | Affected | No fix yet |
| Red Hat AI Inference Server | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix yet |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Self-service automation portal 2 | Affected | No fix yet |
| Red Hat AI Inference Server 3.4 | Fixed | RHSA-2026:83112, RHSA-2026:83114, RHSA-2026:83116, RHSA-2026:83120, RHSA-2026:83121 |
| Red Hat AI Inference Server 3.5 | Fixed | RHSA-2026:82059, RHSA-2026:82061, RHSA-2026:82368, RHSA-2026:82371, RHSA-2026:82415 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:87120 |
| Red Hat Ansible Automation Platform 2.7 | Fixed | RHSA-2026:87124 |
| Red Hat Cost Management On-Premise 1 | Fixed | RHSA-2026:95365 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:94802 |
| Red Hat Enterprise Linux AI 3.4 | Fixed | RHSA-2026:90432, RHSA-2026:90440 |
| Red Hat Enterprise Linux AI 3.5 | Fixed | RHSA-2026:92449, RHSA-2026:92452 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:84578 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:92474 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:84577, RHSA-2026:85929 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2026:85930 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2026:90759 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2026:90494 |
| Red Hat Hardened Images | Fixed | RHSA-2026:69612 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:92510 |
| Red Hat Satellite 6.16 for RHEL 8 | Fixed | RHSA-2026:95655 |
| Red Hat Satellite 6.16 for RHEL 9 | Fixed | RHSA-2026:95655 |
| Red Hat Satellite 6.17 for RHEL 9 | Fixed | RHSA-2026:95656 |
| Red Hat Satellite 6.18 | Fixed | RHSA-2026:92667 |
| Red Hat Satellite 6.18 for RHEL 9 | Fixed | RHSA-2026:95657 |
| Red Hat Satellite 6.19 | Fixed | RHSA-2026:92666 |
| Red Hat Satellite 6.19 for RHEL 9 | Fixed | RHSA-2026:92861 |
| Red Hat Trusted Artifact Signer 1.4 | Fixed | RHSA-2026:84785 |
| Red Hat Trusted Artifact Signer 1.5 | Fixed | RHSA-2026:95267 |
Not affected: 30 products
- Confidential Compute Attestation
- Lightspeed Services for Advanced Cluster Management
- OpenShift Lightspeed
- OpenShift Service Mesh 3
- Pen Drive Powered by Red Hat Lightspeed
- Red Hat AI Inference Server
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.7
- Red Hat Ansible Automation Platform Ansible Core 2
- Red Hat Developer Hub 1
- Red Hat Discovery 2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux command line assistant
- Red Hat Hardened Images
- Red Hat Lightspeed Services for OCP
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 3.4
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Red Hat Satellite 6.17 for RHEL 9
- Red Hat Satellite 6.18 for RHEL 9
- Red Hat Satellite 6.19 for RHEL 9
- Red Hat Update Infrastructure 4 for Cloud Providers
- Red Hat build of Quarkus Native builder
- Service Telemetry Framework 1.5
Timeline
- 2026-10-02 Threatist record created from CVE-2026-97689
- 2026-10-03 Alias added: GHSA-vxq7-64xx-v4gw
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-11 Affected versions changed · Red Hat
- 2026-10-13 Fix available: RHSA-2026:82061 · Red Hat
- 2026-10-13 Fix available: RHSA-2026:82059 · Red Hat
- 2026-10-13 Fix available: Red Hat AI Inference Server 3.5 · Red Hat
- 2026-10-13 CVSS score added · NVD
- 2026-10-14 Fix available: RHSA-2026:82368 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82415 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82371 · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83112 · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83116 · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83114 · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83120 · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83121 · Red Hat
- 2026-10-16 Fix available: Red Hat AI Inference Server 3.4 · Red Hat
- 2026-10-19 Fix available: RHSA-2026:84578 · Red Hat
- 2026-10-19 Fix available: RHSA-2026:84577 · Red Hat
- 2026-10-19 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 9) · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84785 · Red Hat
- 2026-10-20 Fix available: Red Hat Trusted Artifact Signer 1.4 · Red Hat
- 2026-10-20 Fix available: RHSA-2026:85929 · Red Hat
- 2026-10-21 Affected versions changed · Red Hat
- 2026-10-22 Fix available: RHSA-2026:87124 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:87120 · Red Hat
- 2026-10-22 Fix available: Red Hat Ansible Automation Platform 2.6, Red Hat Ansible Automation Platform 2.7 · Red Hat
- 2026-10-23 Affected versions changed · Red Hat
- 2026-10-27 Fix available: Red Hat Enterprise Linux BaseOS (v. 9) · Red Hat
- 2026-10-29 Fix available: Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat
- 2026-10-29 Fix available: RHSA-2026:90494 · Red Hat
- 2026-10-29 Fix available: RHSA-2026:90759 · Red Hat
- 2026-10-29 Fix available: Red Hat Enterprise Linux AI 3.4, Red Hat Enterprise Linux AppStream (v. 8) · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92452 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92449 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:90432 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:90440 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92474 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
- 2026-10-30 Fix available: Red Hat Enterprise Linux AI 3.5, Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-30 Fix available: Red Hat Satellite 6.18, Red Hat Satellite 6.19, Red Hat Satellite 6.19 for RHEL 9 · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92666 · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92667 · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92861 · Red Hat
- 2026-11-02 Fix available: Red Hat Enterprise Linux BaseOS (v. 10) · Red Hat
- 2026-11-03 Fix available: RHSA-2026:85930 · Red Hat
- 2026-11-04 Fix available: RHSA-2026:94802 · Red Hat
- 2026-11-04 Fix available: Red Hat Discovery 2 · Red Hat
- 2026-11-05 Fix available: Red Hat Cost Management On-Premise 1, Red Hat Trusted Artifact Signer 1.5 · Red Hat
- 2026-11-06 Fix available: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9 +1 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95267 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95365 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95656 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95655 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95657 · Red Hat
References
Advisory 2
More python-pillow Urllib3 vulnerabilities
- TI-2026-17326 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVSS 4.0HIGH 8.9
- TI-2018-14221 urllib3 before version 1.23 does not remove the Authorization HTTP header when following… CVSS 3.0CRITICAL 9.8
- TI-2025-40854 urllib3 allows an unbounded number of links in the decompression chain CVSS 4.0HIGH 8.9
- TI-2026-32373 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API CVSS 4.0HIGH 8.9
- TI-2025-40898 urllib3 Streaming API improperly handles highly compressed data CVSS 4.0HIGH 8.9
- TI-2021-12905 An issue was discovered in urllib3 before 1.26.5. CVSS 3.1HIGH 7.5
Sources
- CVE-2026-97689 · CVE Program
- CVE-2026-97689 · NVD
- FIRST EPSS
- GHSA-vxq7-64xx-v4gw · GitHub Advisory Database · CC BY 4.0
- CVE-2026-97689 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences