CGA-6827-rphw-2wh8

This vulnerability affects urllib3 1.26.20, a transitive dependency in the GitLab toolbox component. The vulnerability is fixed in urllib3 >= 2.6.3, but upgrading is blocked by Python version constraints in the dependency chain.

Dependency Chain:

• GitLab CNG uses Python 3.9.23
• awscli 1.42.7 → botocore 1.40.7
• botocore 1.40.7 requires urllib3<1.27,>=1.25.4 (when python_version < "3.10")
• This constraint forces urllib3 1.26.x (incompatible with fix requiring 2.6.3+)

The botocore urllib3 constraint changes based on Python version:

• Python < 3.10: urllib3<1.27 (forces 1.x branch)
• Python >= 3.10: urllib3<3 (allows 2.x branch with fix)

With Python 3.9, the package is locked to urllib3 1.26.x and cannot upgrade to the fixed 2.6.3+ version without breaking the dependency resolver. Upgrading urllib3 requires either upgrading to Python 3.10+ or removing/replacing awscli.

In order to remediate this vulnerability, upstream GitLab must upgrade the CNG toolbox component to Python 3.10 or later, which will allow botocore's urllib3 constraint to permit the 2.x branch containing the security fix.