Skip to content

[Aikido] Fix security issue in urllib3 via minor version upgrade from 2.6.3 to 2.7.0#138

Merged
rtuszik merged 1 commit into
mainfrom
fix/aikido-security-update-packages-33576719-9rlo
May 12, 2026
Merged

[Aikido] Fix security issue in urllib3 via minor version upgrade from 2.6.3 to 2.7.0#138
rtuszik merged 1 commit into
mainfrom
fix/aikido-security-update-packages-33576719-9rlo

Conversation

@aikido-autofix
Copy link
Copy Markdown
Contributor

Upgrade urllib3 to fix DoS vulnerability in streaming decompression that could cause excessive CPU and memory consumption when processing compressed responses.

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-44432
HIGH
[urllib3] Streaming API decompression flaw causes excessive resource consumption (CPU and memory) when handling compressed responses from untrusted sources, particularly with Brotli-encoded data or when drain_conn() is called after partial decompression.

@aikido-autofix aikido-autofix Bot added the security Label created by Aikido AutoFix label May 12, 2026
@rtuszik rtuszik merged commit a001163 into main May 12, 2026
10 checks passed
@rtuszik rtuszik deleted the fix/aikido-security-update-packages-33576719-9rlo branch May 12, 2026 19:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security Label created by Aikido AutoFix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant