QSN-8926-1: urllib3 vulnerabilities
2026-10-14

Summary:
Several security issues were fixed in urllib3.

Details:
Yu-Fu Fu, Seth Larson and Yonatan Magier discovered that urllib3 did not
correctly handle certain certificate validations. An attacker could
possibly use this issue to observe or modify forwarded traffic. This
issue only affected Ubuntu 26.04 LTS. (CVE-2026-97687)

Martin Desrumaux discovered that urllib3 did not correctly handle
decoding certain deflate responses. An attacker could possibly use this
issue to cause a denial of service. This issue only affected
Ubuntu 26.04 LTS. (CVE-2026-97688)

It was discovered that urllib3 did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial
of service. (CVE-2026-97689)

Affected QuantaStor releases:
  6.9.1.001 jammy: python3-urllib3 1.26.5-1~exp1ubuntu0.8 (fixed in 1.26.5-1~exp1ubuntu0.8)
  6.9.0.464 jammy: python3-urllib3 1.26.5-1~exp1ubuntu0.8 (fixed in 1.26.5-1~exp1ubuntu0.8)
  6.8.6.015 jammy: python3-urllib3 1.26.5-1~exp1ubuntu0.7 (fixed in 1.26.5-1~exp1ubuntu0.8)
  6.8.5.018 jammy: python3-urllib3 1.26.5-1~exp1ubuntu0.7 (fixed in 1.26.5-1~exp1ubuntu0.8)
  6.8.4.038 jammy: python3-urllib3 1.26.5-1~exp1ubuntu0.7 (fixed in 1.26.5-1~exp1ubuntu0.8)
  6.8.3.018 jammy: python3-urllib3 1.26.5-1~exp1ubuntu0.7 (fixed in 1.26.5-1~exp1ubuntu0.8)
  6.8.2.002 jammy: python3-urllib3 1.26.5-1~exp1ubuntu0.7 (fixed in 1.26.5-1~exp1ubuntu0.8)
  6.8.1.007 jammy: python3-urllib3 1.26.5-1~exp1ubuntu0.7 (fixed in 1.26.5-1~exp1ubuntu0.8)
  6.8.0.205 jammy: python3-urllib3 1.26.5-1~exp1ubuntu0.7 (fixed in 1.26.5-1~exp1ubuntu0.8)

CVEs: CVE-2026-97688, CVE-2026-97687, CVE-2026-97689

References:
  https://ubuntu.com/security/notices/USN-8926-1