openSUSE Ships Fix for Three urllib3 Vulnerabilities Affecting Tumbleweed Python Packages
openSUSE has issued advisory openSUSE-SU-2026:12119-1, a moderate-rated update that resolves three vulnerabilities in the urllib3 Python HTTP client library shipped on openSUSE Tumbleweed GA media. The fixed build is python313-urllib3_1 version 1.26.20-8.1, with the companion python314-urllib3_1 package carried at the same version. Three CVEs are referenced: CVE-2026-97687, scored 7.4 under CVSS v3.1 and 9.1 under CVSS v4.0; CVE-2026-97688 at 5.3 and 6.9 respectively; and CVE-2026-97689 at 7.5. Only openSUSE Tumbleweed is listed as an affected product.
The advisory does not publish exploitation details or proof-of-concept material, so the mechanism behind each flaw is known only from the published scoring vectors. All three are rated as remotely reachable with no privileges and no user interaction required. CVE-2026-97687 carries high attack complexity and affects confidentiality and integrity, CVE-2026-97688 produces a limited availability impact, and CVE-2026-97689 describes a high availability impact with low attack complexity. Because urllib3 handles outbound HTTP traffic, exposure typically follows the servers an application connects to and the responses it parses.
urllib3 sits beneath a large share of Python tooling and frequently arrives as a transitive dependency rather than a deliberate install, so one library defect can surface across build agents, container images and automation hosts that nobody tracks as internet-facing software. Tumbleweed is the stated scope, and the same package version covers both Python 3.13 and 3.14 builds. FIRST EPSS places the probability of exploitation in the next thirty days at 0.2 percent for CVE-2026-97687 and 0.3 percent for both CVE-2026-97688 and CVE-2026-97689, with no reported in-the-wild activity.
Attack Surface
Supply Chain (Third-party vendors), Server OS
Tactics
Impact, Initial Access
Techniques
- T1499 – Endpoint Denial of Service
- T1195.001 – Compromise Software Dependencies and Development Tools
SuperPRO's Threat Countermeasures Procedures
- Apply advisory openSUSE-SU-2026:12119-1 on openSUSE Tumbleweed hosts by running 'zypper refresh && zypper up python313-urllib3_1 python314-urllib3_1' so both packages reach version 1.26.20-8.1.
- Confirm the installed build afterwards with 'rpm -q python313-urllib3_1 python314-urllib3_1' and treat any host still reporting a release older than 1.26.20-8.1 as outstanding.
- Enumerate pip-installed and vendored copies of urllib3 with 'pip list | grep urllib3' inside virtualenvs, Poetry and conda environments, since those site-packages copies are not replaced by the zypper update of python313-urllib3_1.
- Rebuild and redeploy container images based on openSUSE Tumbleweed GA media that bundle urllib3 1.26.20, and re-scan the resulting layers for CVE-2026-97687, CVE-2026-97688 and CVE-2026-97689.
- Given the high availability impact rated for CVE-2026-97689, alert on repeated worker crashes, unbounded memory growth or hung HTTP client threads in long-running Python services, and apply systemd Restart= and MemoryMax= limits to those units as a containment measure.
- Route outbound HTTP and HTTPS from Python automation and build hosts through an egress proxy with a destination allow-list, since all three CVSS vectors are AV:N with no authentication and exposure arises from the remote endpoints the client contacts.
- Pin urllib3 in requirements.txt or constraints files to the distribution-patched level so a later 'pip install' cannot reintroduce an unpatched 1.26.x build onto remediated systems.
