urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8926-1 advisory.

    Yu-Fu Fu, Seth Larson and Yonatan Magier discovered that urllib3 did not correctly handle certain     certificate validations. An attacker could possibly use this issue to observe or modify forwarded traffic.
    This issue only affected Ubuntu 26.04 LTS. (CVE-2026-97687)

    Martin Desrumaux discovered that urllib3 did not correctly handle decoding certain deflate responses. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04     LTS. (CVE-2026-97688)

    It was discovered that urllib3 did not correctly handle certain memory operations. An attacker could     possibly use this issue to cause a denial of service. (CVE-2026-97689)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4704-1 advisory.

    - CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override     (bsc#1283908).
    - CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding (bsc#1283909).
    - CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser (bsc#1283910).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4649-1 advisory.

    - CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding (bsc#1283909).
    - CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser (bsc#1283910).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4650-1 advisory.

    - CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding (bsc#1283909).
    - CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser (bsc#1283910).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and
    HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as
    unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue
    occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive
    finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-
    Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N
    streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked
    response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request
    that does not complete, and network read timeouts do not interrupt the loop because no further socket read
    occurs. This issue is fixed in version 2.8.0. (CVE-2026-97688)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and     HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as     unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue     occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive     finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-     Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N     streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked     response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request     that does not complete, and network read timeouts do not interrupt the loop because no further socket read     occurs. This issue is fixed in version 2.8.0. (CVE-2026-97688)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
367208	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : urllib3 vulnerabilities (USN-8926-1)	Nessus	Ubuntu Local Security Checks	Local	high
366748	SUSE SLED15 / SLES15 Security Update : python-urllib3 (SUSE-SU-2026:4704-1)	Nessus	SuSE Local Security Checks	Local	high
366063	SUSE SLES12 Security Update : python-urllib3 (SUSE-SU-2026:4649-1)	Nessus	SuSE Local Security Checks	Local	high
366036	SUSE SLED15 / SLES15 Security Update : python-urllib3 (SUSE-SU-2026:4650-1)	Nessus	SuSE Local Security Checks	Local	high
462030	Echo: python-3.11: security update to 3.11.17+e2urllib3: security update to 2.8.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
462030	Echo: python-3.11: security update to 3.11.17+e2urllib3: security update to 2.8.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
358328	Linux Distros Unpatched Vulnerability : CVE-2026-97688	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-97688

medium

Tenable Plugins

high

high

high

high

medium

medium

medium