Red Hat Updates urllib3 for Two RHEL Security Flaws
Tech GuruQuick Answer
Red Hat published RHSA-2026:84578 and RHSA-2026:84577 for python3.14-urllib3 on RHEL 9 and RHEL 10. The supported packages address two urllib3 vulnerabilities in the listed RHEL streams. Match each entitled system to the exact advisory relationship, apply python3.14-urllib3 2.6.3-2.el9_8.6 or 2.6.3-2.el10_2.6 for the matching stream, validate dependent operations, and retain evidence.
Match The Entitled RHEL Stream And Apply Its Supported Package
What to do now: Inventory python3.14-urllib3 on RHEL 9 and RHEL 10, compare installed NEVRAs and entitlements with the exact Red Hat product relationships, apply python3.14-urllib3 2.6.3-2.el9_8.6 or 2.6.3-2.el10_2.6 for the matching stream, validate dependent workloads, and preserve change evidence.
Last verified: 2026-10-19 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | python3.14-urllib3 on RHEL 9 and RHEL 10 |
|---|---|
| Advisory | RHSA-2026:84578 / RHSA-2026:84577 |
| CVEs | CVE-2026-97687, CVE-2026-97689 |
| Authoritative release date | 2026-10-19 01:55:59 UTC |
| Authority revision date | 2026-10-19 02:01:12 UTC |
| Affected versions | The RHEL 9 and RHEL 10 python3.14-urllib3 relationships listed by the advisories. |
| Fixed version | python3.14-urllib3 2.6.3-2.el9_8.6 or 2.6.3-2.el10_2.6 for the matching stream |
| CVSS base score | 7.4 / 7.5 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | Not stated by Red Hat; no exploitation claim is inferred. |
What Changed
The supported packages address two urllib3 vulnerabilities in the listed RHEL streams.
What To Validate Now
- Inventory. Locate python3.14-urllib3 on RHEL 9 and RHEL 10; record the installed NEVRA, RHEL minor stream, repository and entitlement, accountable owner, exposure, dependent workloads, and maintenance group.
- Establish applicability. Use the product-status relationships in RHSA-2026:84578 and RHSA-2026:84577. The RHEL 9 and RHEL 10 python3.14-urllib3 relationships listed by the advisories. Do not transfer package applicability between RHEL branches.
- Remediate. Install python3.14-urllib3 2.6.3-2.el9_8.6 or 2.6.3-2.el10_2.6 for the matching stream from the supported Red Hat repository for the matching entitled branch, following the current advisory and local change controls.
- Validate. Confirm the installed NEVRA and repository, restart affected services when required, exercise representative workloads and recovery paths, monitor for regressions, and document exceptions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported package for each entitled RHEL stream. Test dependent applications and rollback before broad deployment; the advisory severity does not establish exploitation or applicability to a particular system.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
