Three urllib3 Vulnerabilities in One Python Security Scan: CVE-2026-97689, CVE-2026-97688 and CVE-2026-97687

A dependency audit can uncover several unrelated security issues in a single pinned package. The important question is not just how many warnings appear, but whether each advisory refers to a distinct flaw, which versions are affected, and what the scan itself actually demonstrated.

On October 29, 2026, we used the deployed LegacyFixer application to scan a private GitHub test repository pinned to urllib3==2.7.0. The production report returned three distinct vulnerability entries, each with 2.8.0 as the reported fix version. The run was intentionally detect-only: it did not open a pull request or modify repository files.

Why urllib3 2.7.0 matters

urllib3 is a widely used Python HTTP client library. On September 15, 2026, its maintainers released urllib3 2.8.0 with fixes for three security issues involving HTTP streaming and HTTPS proxy TLS configuration. These issues have separate GitHub advisories and CVE identifiers. The package version used in our test, 2.7.0, falls within all three affected ranges.

The severity scores above come from upstream advisory records; they were not calculated or displayed as severity ratings by this LegacyFixer scan. The CVE mappings also come from the advisory databases: the scan report itself displayed the PYSEC identifiers.

What the three vulnerabilities can affect

CVE-2026-97689: excessive memory use while parsing streamed responses

When an application streams a chunked HTTP response from an untrusted server, the affected code can buffer an exceptionally long chunk-size field before detecting that it is invalid. The upstream advisory GHSA-vxq7-64xx-v4gw identifies HTTPResponse.stream() and read_chunked() as affected paths. Under the relevant conditions, this can cause excessive memory allocation and denial of service. The 2.8.0 fix limits the accepted chunk-size field length.

CVE-2026-97688: an infinite loop in chunked Deflate streaming

The Deflate advisory GHSA-gh4c-6fx4-qh6g describes a case where a streamed, compressed response contains trailing bytes after the end of the Deflate stream. With content decoding enabled and a finite positive streaming chunk size, the client can repeatedly process the same bytes without progress. This can consume CPU and leave the request hanging; ordinary network read timeouts do not resolve a loop that performs no further socket reads.

CVE-2026-97687: incorrect TLS settings for HTTPS proxies

The HTTPS proxy advisory GHSA-8988-9cw3-xx77 documents cases where settings intended for the destination server could override settings intended for the HTTPS proxy. Depending on how the proxy is configured, this can weaken certificate verification or apply destination-specific credentials or identity checks at the proxy connection. Exploitability depends on the application's actual HTTPS proxy and TLS configuration; the package version alone does not prove that traffic was exposed.

The controlled LegacyFixer test

We created Dom-33/legacyfixer-urllib3-cve-test, a private GitHub repository, containing this minimal requirements.txt:

urllib3==2.7.0

The repository was authorized in the LegacyFixer GitHub App, selected in the dashboard, and scanned through the deployed application. Optional fix PRs were disabled. This was an actual remote scan, not a fabricated report or a local-only mock.

Production scan #231: observed results

The LegacyFixer dashboard and saved report showed the following on October 29, 2026:

The dependency audit displayed these three unique package/version/advisory combinations:

Unlike two alternative advisory identifiers describing one underlying vulnerability, these three records map to three separate CVEs. We verified the mappings against the PyPA Advisory Database and OSV, independently of the scan output.

The success / NO_ACTION / passive_findings result means the scan completed and reported known vulnerabilities, but did not perform a repository-changing fix. NO_ACTION is not a clean bill of health. The report explicitly confirmed that no pull request was opened.

Remediation and appropriate verification

For the deliberately vulnerable test requirement, the upstream-recommended patched version is urllib3 2.8.0. A proposed update to the pinned dependency would be:

urllib3==2.8.0

This is a remediation example, not a change performed during scan #231. We did not run a post-upgrade scan, install a patched build as part of this experiment, or demonstrate exploitation. A production team should check compatibility, test HTTPS proxy TLS behavior where relevant, and re-audit the resolved dependency tree after making an upgrade. The upstream 2.8.0 notes specifically call out a change to HTTPS proxy TLS configuration that may require adjustment in applications relying on the previous behavior.

What this scan demonstrates—and what it does not

This experiment verifies a narrow but useful end-to-end behavior: for a controlled GitHub repository pinned to urllib3==2.7.0, LegacyFixer detected three known advisory entries, preserved their reported fix version, and left the repository unchanged in detect-only mode. External advisory records establish which three CVEs those entries represent.

It does not establish that the test repository contained an exploitable application, that every urllib3 security issue would be detected, or that an upgrade will be compatible with every deployment. In practical dependency maintenance, finding a vulnerable package and determining actual application exposure are distinct steps.

Sources and verification

• urllib3 2.8.0 — upstream release notes, September 15, 2026
• GHSA-vxq7-64xx-v4gw — unbounded chunk-size field
• GHSA-gh4c-6fx4-qh6g — chunked Deflate infinite loop
• GHSA-8988-9cw3-xx77 — HTTPS proxy TLS configuration
• PYSEC-2026-4177 / CVE-2026-97689
• PYSEC-2026-4176 / CVE-2026-97688
• PYSEC-2026-4175 / CVE-2026-97687

Scan and verification date: October 29, 2026. Advisory information and available patched releases may change; consult upstream records when planning a production update.