From afa95d8a612bfa95742ab4a74845523267e008f7 Mon Sep 17 00:00:00 2001 From: Jan-Kazlouski-elastic Date: Thu, 16 Jul 2026 23:49:56 +0300 Subject: [PATCH] fix(deps): pin urllib3 to 2.7.0 for CVE-2026-9375 urllib3 <2.7.0 (shipped transitively via requests) can bypass the streaming decompression-bomb safeguards (drain_conn after a partial read, and a second Brotli read/stream), enabling a malicious HTTP server to trigger an OOM DoS. Pin urllib3 directly to the fixed 2.7.0 release; no parent dependency forces a fixed version. Closes https://github.com/elastic/security/issues/12535 Co-authored-by: Cursor --- app/connectors_service/pyproject.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/app/connectors_service/pyproject.toml b/app/connectors_service/pyproject.toml index d8e8e503f..d122e9942 100644 --- a/app/connectors_service/pyproject.toml +++ b/app/connectors_service/pyproject.toml @@ -72,6 +72,7 @@ dependencies = [ "SQLAlchemy[asyncio]==2.0.1; platform_machine=='arm64'", "tabulate==0.9.0", "tzcron==1.0.0", + "urllib3==2.7.0", "uvloop==0.20.0; sys_platform != 'win32'", "wcmatch==8.4.1", "elasticsearch-connectors-sdk @ file:../../libs/connectors_sdk"