[Bug 2138420] Re: backport of CVE-2026-21441 results in broken package

[Hlib Korzhynskyy]

Hello,
Thank you for the bug report. I have confirmed the issue and have begun working on a fix, which should be available on Monday.

In the meantime, I have uploaded version 1.26.5-1~exp1ubuntu0.6 of the
package to a testing PPA which should have this issue resolved. If you
can, please test the package and see if the issue still persists:

https://launchpad.net/~ubuntu-security-
proposed/+archive/ubuntu/ppa/+packages?field.name_filter=python-
urllib3&field.status_filter=published&field.series_filter=

Thanks

** Changed in: python-urllib3 (Ubuntu)
     Assignee: (unassigned) => Hlib Korzhynskyy (hlibk)

** Changed in: python-urllib3 (Ubuntu)
       Status: New => In Progress

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to python-urllib3 in Ubuntu.
https://bugs.launchpad.net/bugs/2138420

Title:
  backport of CVE-2026-21441 results in broken package

Status in python-urllib3 package in Ubuntu:
  In Progress

Bug description:
  the backport to urllib3 1.26.5  is a copy and paste of code from
  urllib3 2.x that makes no sense in urllib3 1.x

  There is no tracking of decoded response data in urllib3 1.x
  `HTTPResponse` class. Using the API from 2.x `BaseHTTPResponse` class
  in 1.x `HTTPResponse` class does not make sense in this case.

  As a result, accessing the `self._has_decoded_data` property which
  only exists in 2.x new `BaseHTTPResponse` is not valid in 1.x
  `HTTPResponse` and any code that uses response streaming in Jammy will
  fail.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/python-urllib3/+bug/2138420/+subscriptions