Loading vulnerability…
CVE-2026-97689 is an unbounded memory allocation vulnerability in the Python HTTP client library urllib3, affecting versions 1.10.3 through versions before 2.8.0. The HTTPResponse.read_chunked() and HTTPResponse.stream() methods buffer the chunk-size field of a chunked HTTP response until a newline or end-of-file without enforcing a length limit. A malicious HTTP server can return a response with Transfer-Encoding: chunked followed by an excessively long, unterminated chunk-size line, causing uncontrolled memory consumption and potentially exhausting the client process. Version 2.8.0 fixes the issue by rejecting chunk-size fields exceeding 65,536 bytes.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in urllib3's chunk parser permits unbounded memory allocation, potentially causing denial of service. The advisory identifies the python3.14-urllib3 package on RHEL 9 as affected and provides a security update through RHSA-2026:84577. Nessus checks the reported package version rather than testing exploitation.
A denial-of-service vulnerability in urllib3 caused by unbounded memory allocation in its chunk parser. The advisory identifies the python3.14-urllib3 package on RHEL 10 as affected. The listed CVSS v4 base score is 8.9. Nessus detects affected package versions rather than testing exploitation.
A denial-of-service vulnerability in urllib3 caused by unbounded memory allocation in its chunk parser. Red Hat advisory RHSA-2026:84578 provides a fix in python3.14-urllib3-2.6.3-2.el10_2.6 for affected Red Hat Enterprise Linux 10 products. The advisory rates the security update Important.
A vulnerability in urllib3's chunk parser permits unbounded memory allocation, potentially causing denial of service. Red Hat advisory RHSA-2026:84577 provides a fix in python3.14-urllib3-2.6.3-2.el9_8.6 for affected Red Hat Enterprise Linux 9 products. The advisory rates the update Important.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.