← All notices | Source (USN-8926-1) | Text version
QSN-8926-1: urllib3 vulnerabilities
October 14, 2026
Summary
Several security issues were fixed in urllib3.
Details
Yu-Fu Fu, Seth Larson and Yonatan Magier discovered that urllib3 did not correctly handle certain certificate validations. An attacker could possibly use this issue to observe or modify forwarded traffic. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-97687)
Martin Desrumaux discovered that urllib3 did not correctly handle decoding certain deflate responses. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-97688)
It was discovered that urllib3 did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-97689)
Affected QuantaStor releases
| Release | Platform | Package | Exposure | Shipped version | Fixed version | Status |
|---|---|---|---|---|---|---|
| 6.9.1.001 | Ubuntu 22.04 LTS | python3-urllib3 | Externally-facing | 1.26.5-1~exp1ubuntu0.8 | 1.26.5-1~exp1ubuntu0.8 | Fixed in this release |
| 6.9.0.464 | Ubuntu 22.04 LTS | python3-urllib3 | Externally-facing | 1.26.5-1~exp1ubuntu0.8 | 1.26.5-1~exp1ubuntu0.8 | Fixed in this release |
| 6.8.6.015 | Ubuntu 22.04 LTS | python3-urllib3 | Externally-facing | 1.26.5-1~exp1ubuntu0.7 | 1.26.5-1~exp1ubuntu0.8 | Fixed by QuantaStor security update |
| 6.8.5.018 | Ubuntu 22.04 LTS | python3-urllib3 | Externally-facing | 1.26.5-1~exp1ubuntu0.7 | 1.26.5-1~exp1ubuntu0.8 | Fixed by QuantaStor security update |
| 6.8.4.038 | Ubuntu 22.04 LTS | python3-urllib3 | Externally-facing | 1.26.5-1~exp1ubuntu0.7 | 1.26.5-1~exp1ubuntu0.8 | Fixed by QuantaStor security update |
| 6.8.3.018 | Ubuntu 22.04 LTS | python3-urllib3 | Externally-facing | 1.26.5-1~exp1ubuntu0.7 | 1.26.5-1~exp1ubuntu0.8 | Fixed by QuantaStor security update |
| 6.8.2.002 | Ubuntu 22.04 LTS | python3-urllib3 | Externally-facing | 1.26.5-1~exp1ubuntu0.7 | 1.26.5-1~exp1ubuntu0.8 | Fixed by QuantaStor security update |
| 6.8.1.007 | Ubuntu 22.04 LTS | python3-urllib3 | Externally-facing | 1.26.5-1~exp1ubuntu0.7 | 1.26.5-1~exp1ubuntu0.8 | Fixed by QuantaStor security update |
| 6.8.0.205 | Ubuntu 22.04 LTS | python3-urllib3 | Externally-facing | 1.26.5-1~exp1ubuntu0.7 | 1.26.5-1~exp1ubuntu0.8 | Fixed by QuantaStor security update |
Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.
CVEs
CVE-2026-97688, CVE-2026-97687, CVE-2026-97689
References
https://ubuntu.com/security/notices/USN-8926-1
https://nvd.nist.gov/vuln/detail/CVE-2026-97688
https://nvd.nist.gov/vuln/detail/CVE-2026-97687
https://nvd.nist.gov/vuln/detail/CVE-2026-97689
Update
Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:
| Platform | Package | Version |
|---|---|---|
| bionic | python-urllib3 | 1.22-1ubuntu0.18.04.2+esm5 |
| Ubuntu 20.04 LTS | python-urllib3 | 1.25.8-2ubuntu0.4+esm6 |
| Ubuntu 22.04 LTS | python-urllib3 | 1.26.5-1~exp1ubuntu0.8 |
| Ubuntu 24.04 LTS | python-urllib3 | 2.0.7-1ubuntu0.8 |
| resolute | python-urllib3 | 2.6.3-1ubuntu1.2 |