shield Security update for python-urllib3

SUSE-SLE-Module-Public-Cloud-12-2026-1412

This update for python-urllib3 fixes the following issues: Security issues: - CVE-2025-66418: resource exhaustion via unbounded number of links in the decompression chain (bsc#1254866). - CVE-2025-66471: excessive resource consumption via decompression of highly compressed data in Streaming API (bsc#1254867). - CVE-2026-21441: excessive resource consumption during decompression of data in HTTP redirect responses (bsc#1256331). Non-security issues: - Disabled response decompression with brotli due to missing brotli feature (jsc#PED-15380).

• Release Date
  Apr 16 2026
• References
  Bugzilla: 1254866, 1254867, 1256331, 1259829
  CVEs: CVE-2025-66418, CVE-2025-66471, CVE-2026-21441
• Type
  security
• Severity
  moderate

cloud_download Downloads

Public Cloud Module 12 s390x

• Packages
  python-urllib3
  HTTP library with thread-safe connection pooling, file post, and more

  1.25.10-3.48.4 lock rpm lock src

  python3-urllib3
  HTTP library with thread-safe connection pooling, file post, and more

  1.25.10-3.48.4 lock rpm

Public Cloud Module 12 ppc64le

• Packages
  python-urllib3
  HTTP library with thread-safe connection pooling, file post, and more

  1.25.10-3.48.4 lock rpm lock src

  python3-urllib3
  HTTP library with thread-safe connection pooling, file post, and more

  1.25.10-3.48.4 lock rpm

Public Cloud Module 12 aarch64

• Packages
  python-urllib3
  HTTP library with thread-safe connection pooling, file post, and more

  1.25.10-3.48.4 lock rpm lock src

  python3-urllib3
  HTTP library with thread-safe connection pooling, file post, and more

  1.25.10-3.48.4 lock rpm

Public Cloud Module 12 x86_64

• Packages
  python-urllib3
  HTTP library with thread-safe connection pooling, file post, and more

  1.25.10-3.48.4 lock rpm lock src

  python3-urllib3
  HTTP library with thread-safe connection pooling, file post, and more

  1.25.10-3.48.4 lock rpm