FEDORA-2026-724d1b1044

Fixed a high-severity security issue where decompression-bomb safeguards of the streaming API were bypassed when HTTP redirects were followed. GHSA-38jv-5279-wg99, CVE-2026-21441
Started treating Retry-After times greater than 6 hours as 6 hours by default.

Fedora:43python-urllib3

Fixed in:

2.6.3-1.fc43

Fedora:43python3-urllib3

Fixed in:

2.6.3-1.fc43

Fedora:43python3-urllib3+brotli

Fixed in:

2.6.3-1.fc43

Fedora:43python3-urllib3+h2

Fixed in:

2.6.3-1.fc43

Fedora:43python3-urllib3+socks

Fixed in:

2.6.3-1.fc43

Fedora:43python3-urllib3+zstd

Fixed in:

2.6.3-1.fc43