合并受阻
Welcome To openEuler Community
Hey @Liuhuiooo , thanks for your contribution to the community.
Bot Usage Manual
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands.
Contact Guide
If you have any questions, please contact the SIG: Networking ,
and any of the maintainers: @Apricity_HW, @MrRlu, @robert-xingwang, @sunsuwan ,
and any of the committers: @jiangheng12138, @zhongxuan2 .
门禁正在运行， 您可以通过以下链接查看实时门禁检查结果.
若您对门禁结果含义不清晰或者遇到问题不知如何解决，可参考门禁指导手册
门禁入口及编码规范检查: multiarch/src-openeuler/trigger/python-urllib3/169/console
当前仓库存在以下 保护分支 ：
评论 /sync <branch1> <branch2> ... 可将当前 PR 修改同步到其它分支（创建同步 PR）：
a) 如果当前 PR 是 Open 状态，同步操作将延迟到 PR 被合并时执行
b) 如果当前 PR 已经 Merged，将立即执行同步操作
注意：
- /sync 命令可以指定同步到多个分支，仅最后一个 /sync 命令生效
- 如果创建的同步 PR 不正确，可通过向同步 PR 的源分支提交轻量级 PR 完善，或使用 /close 命令关闭
aarch64架构构建及构建后检查：multiarch/src-openeuler/aarch64/python-urllib3/169/console
x86_64架构构建及构建后检查：multiarch/src-openeuler/x86-64/python-urllib3/169/console
| Check Name | Build Result | Build Details | |
|---|---|---|---|
| check_binary_file | ✅SUCCESS | #169 | |
| check_lfsconfig | :ballot_box_with_check:EXCLUDE | ||
| check_package_yaml_file | ✅SUCCESS | ||
| check_repo_in_maintain | ✅SUCCESS | ||
| check_consistency | ✅SUCCESS | ||
| check_spec_file | ✅SUCCESS | ||
| x86_64 | check_build | ✅SUCCESS | #169 |
| check_install | ✅SUCCESS | ||
| check_license | ✅SUCCESS | ||
| aarch64 | check_build | ✅SUCCESS | #169 |
| check_install | ✅SUCCESS | ||
| check_license | ✅SUCCESS | ||
如下为接口变更检查结果，目标分支为openEuler-24.03-LTS-SP4，请PR提交者check差异信息
| Arch Name | Check Items | Rpm Name | Check Result | Build Details |
|---|---|---|---|---|
| compare_package(x86_64) | add_rpms | ✅SUCCESS | #169 | |
| delete_rpms | ✅SUCCESS | |||
| rpm_files | ✅SUCCESS | |||
| rpm_provides | ✅SUCCESS | |||
| rpm_requires | ✅SUCCESS | |||
| compare_package(aarch64) | add_rpms | ✅SUCCESS | #169 | |
| delete_rpms | ✅SUCCESS | |||
| rpm_files | ✅SUCCESS | |||
| rpm_provides | ✅SUCCESS | |||
| rpm_requires | ✅SUCCESS |
Fix CVE-2026-9375 (decompression bomb safeguard bypass, CVSS 7.5 High) in python-urllib3 on openEuler-24.03-LTS-SP4 (urllib3 1.26.18).
The streaming-API decompression-bomb safeguards were bypassed: HTTPResponse.drain_conn() called self.read(decode_content=self._has_decoded_content), so after a partial decoded read it would decompress ALL remaining body data. A small compressed bomb thus expands fully in memory. Backports the upstream fix (GHSA-mf9v-mfxr-j63j): drain_conn uses _raw_read (no decompression) and clears the decoder; read() also bounds-checks the decoded buffer before re-decoding the unconsumed tail.
Verified locally on urllib3 1.26.18 (+ the existing SP4 patch stack): an 800 MB gzip bomb (796 KB compressed) detonates via drain_conn() before the patch (RSS 27->1634 MB) and is contained after (27->29 MB).