| Message ID | 20260119103809.2880459-1-peter@korsgaard.com |
|---|---|
| State | Accepted |
| Delegated to: | Julien Olivain |
| Headers | show |
| Series | package/python-urllib3: security bump to version 2.6.3 | expand |
On 19/01/2026 11:38, Peter Korsgaard wrote: > Fixes the following vulnerability: > > CVE-2026-21441: Decompression-bomb safeguards bypassed when following > HTTP > redirects (streaming API) > > https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99 > > Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Applied to master, thanks.
In reply of: > Fixes the following vulnerability: > > CVE-2026-21441: Decompression-bomb safeguards bypassed when following HTTP > redirects (streaming API) > > https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99 > > Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Applied to 2025.02.x & 2025.11.x. Thanks > --- > package/python-urllib3/python-urllib3.hash | 4 ++-- > package/python-urllib3/python-urllib3.mk | 4 ++-- > 2 files changed, 4 insertions(+), 4 deletions(-) > > diff --git a/package/python-urllib3/python-urllib3.hash b/package/python-urllib3/python-urllib3.hash > index 76fe4e5fc9..858b8ca3a3 100644 > --- a/package/python-urllib3/python-urllib3.hash > +++ b/package/python-urllib3/python-urllib3.hash > @@ -1,5 +1,5 @@ > # md5, sha256 from https://pypi.org/pypi/urllib3/json > -md5 838e0ffee00ec870a3ba6727a7832ab8 urllib3-2.6.2.tar.gz > -sha256 016f9c98bb7e98085cb2b4b17b87d2c702975664e4f060c6532e64d1c1a5e797 urllib3-2.6.2.tar.gz > +md5 2c381874816fe551f50a2551abae62b3 urllib3-2.6.3.tar.gz > +sha256 1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed urllib3-2.6.3.tar.gz > # Locally computed sha256 checksums > sha256 130e3a64d5fdd5d096a752694634a7d9df284469de86e5732100268041e3d686 LICENSE.txt > diff --git a/package/python-urllib3/python-urllib3.mk b/package/python-urllib3/python-urllib3.mk > index d57473566b..7f7f0b03d2 100644 > --- a/package/python-urllib3/python-urllib3.mk > +++ b/package/python-urllib3/python-urllib3.mk > @@ -4,9 +4,9 @@ > # > ################################################################################ > > -PYTHON_URLLIB3_VERSION = 2.6.2 > +PYTHON_URLLIB3_VERSION = 2.6.3 > PYTHON_URLLIB3_SOURCE = urllib3-$(PYTHON_URLLIB3_VERSION).tar.gz > -PYTHON_URLLIB3_SITE = https://files.pythonhosted.org/packages/1e/24/a2a2ed9addd907787d7aa0355ba36a6cadf1768b934c652ea78acbd59dcd > +PYTHON_URLLIB3_SITE = https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3 > PYTHON_URLLIB3_LICENSE = MIT > PYTHON_URLLIB3_LICENSE_FILES = LICENSE.txt > PYTHON_URLLIB3_CPE_ID_VENDOR = python > -- > 2.47.3 > > _______________________________________________ > buildroot mailing list > buildroot@buildroot.org > https://lists.buildroot.org/mailman/listinfo/buildroot
diff --git a/package/python-urllib3/python-urllib3.hash b/package/python-urllib3/python-urllib3.hash index 76fe4e5fc9..858b8ca3a3 100644 --- a/package/python-urllib3/python-urllib3.hash +++ b/package/python-urllib3/python-urllib3.hash @@ -1,5 +1,5 @@ # md5, sha256 from https://pypi.org/pypi/urllib3/json -md5 838e0ffee00ec870a3ba6727a7832ab8 urllib3-2.6.2.tar.gz -sha256 016f9c98bb7e98085cb2b4b17b87d2c702975664e4f060c6532e64d1c1a5e797 urllib3-2.6.2.tar.gz +md5 2c381874816fe551f50a2551abae62b3 urllib3-2.6.3.tar.gz +sha256 1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed urllib3-2.6.3.tar.gz # Locally computed sha256 checksums sha256 130e3a64d5fdd5d096a752694634a7d9df284469de86e5732100268041e3d686 LICENSE.txt diff --git a/package/python-urllib3/python-urllib3.mk b/package/python-urllib3/python-urllib3.mk index d57473566b..7f7f0b03d2 100644 --- a/package/python-urllib3/python-urllib3.mk +++ b/package/python-urllib3/python-urllib3.mk @@ -4,9 +4,9 @@ # ################################################################################ -PYTHON_URLLIB3_VERSION = 2.6.2 +PYTHON_URLLIB3_VERSION = 2.6.3 PYTHON_URLLIB3_SOURCE = urllib3-$(PYTHON_URLLIB3_VERSION).tar.gz -PYTHON_URLLIB3_SITE = https://files.pythonhosted.org/packages/1e/24/a2a2ed9addd907787d7aa0355ba36a6cadf1768b934c652ea78acbd59dcd +PYTHON_URLLIB3_SITE = https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3 PYTHON_URLLIB3_LICENSE = MIT PYTHON_URLLIB3_LICENSE_FILES = LICENSE.txt PYTHON_URLLIB3_CPE_ID_VENDOR = python
Fixes the following vulnerability: CVE-2026-21441: Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> --- package/python-urllib3/python-urllib3.hash | 4 ++-- package/python-urllib3/python-urllib3.mk | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)