[wrynose,3/3] python3-urllib3: Fix CVE-2026-97688

diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688-regression.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688-regression.patch
new file mode 100644
index 0000000000..220b024e1e
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688-regression.patch
@@ -0,0 +1,29 @@ 
+From 9016d7e8afc68185496ef07f3c3a4a743d04922e Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Tue, 15 Sep 2026 22:04:41 +0300
+Subject: [PATCH] Skip `test_read_chunked_with_trailing_data_does_not_hang` for
+ brotlicffi (#5258)
+
+CVE: CVE-2026-97688
+Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e]
+
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ test/test_response.py | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/test/test_response.py b/test/test_response.py
+index 5ecdbd9..24118f6 100644
+--- a/test/test_response.py
++++ b/test/test_response.py
+@@ -831,6 +831,8 @@ class TestResponse:
+         # while trailing data remains in the decoder's input buffer.
+         original_data = b"A" * 100
+         content_encoding, compress_func = data
++        if content_encoding == "br" and brotli.__name__ == "brotlicffi":
++            pytest.skip("This case is not supported by brotlicffi")
+         compressed_data = compress_func(original_data) + b"tail"
+         httplib_r = httplib.HTTPResponse(MockSock)  # type: ignore[arg-type]
+         httplib_r.fp = MockChunkedEncodingResponse([compressed_data])  # type: ignore[assignment]
+--
+2.35.6
diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688.patch
new file mode 100644
index 0000000000..4fcdce68fc
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688.patch
@@ -0,0 +1,107 @@ 
+From ea2ad7b21a80da3632f80016526a18864586077f Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Tue, 15 Sep 2026 21:32:04 +0300
+Subject: [PATCH] Merge commit from fork
+
+* Prevent an infinite loop when decoding Deflate responses
+
+* Move the new test to a better place
+
+* Add a changelog entry
+
+CVE: CVE-2026-97688
+Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f]
+
+Backport Changes:
+- Omitted changelog/GHSA-gh4c-6fx4-qh6g.bugfix.rst because the OE recipe
+  backport applies the runtime fix and tests; the package does not ship it.
+
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ src/urllib3/response.py |  8 +++++++-
+ test/test_response.py   | 38 +++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 44 insertions(+), 2 deletions(-)
+
+diff --git a/src/urllib3/response.py b/src/urllib3/response.py
+index e9e0cee75e..dccdb12936 100644
+--- a/src/urllib3/response.py
++++ b/src/urllib3/response.py
+@@ -76,6 +76,10 @@ def __init__(self) -> None:
+     def decompress(self, data: bytes, max_length: int = -1) -> bytes:
+         data = self._unfed_data + data
+         self._unfed_data = b""
++        # Data received after EOF cannot produce more output from this
++        # Deflate stream.
++        if self._obj.eof:
++            return b""
+         if not data and not self._obj.unconsumed_tail:
+             return data
+         original_max_length = max_length
+@@ -118,7 +122,9 @@ def decompress(self, data: bytes, max_length: int = -1) -> bytes:
+     @property
+     def has_unconsumed_tail(self) -> bool:
+         return bool(self._unfed_data) or (
+-            bool(self._obj.unconsumed_tail) and not self._first_try
++            bool(self._obj.unconsumed_tail)
++            and not self._first_try
++            and not self._obj.eof
+         )
+ 
+     def flush(self) -> bytes:
+
+diff --git a/test/test_response.py b/test/test_response.py
+index 799325b58c..4675646232 100644
+--- a/test/test_response.py
++++ b/test/test_response.py
+@@ -11,7 +11,7 @@
+ from base64 import b64decode
+ from http.client import IncompleteRead as httplib_IncompleteRead
+ from io import BufferedReader, BytesIO, TextIOWrapper
+-from test import onlyBrotli, onlyZstd
++from test import LONG_TIMEOUT, onlyBrotli, onlyZstd
+ from unittest import mock
+ 
+ import pytest
+@@ -813,6 +813,42 @@ def test_read_chunked_with_all_data_already_in_decompressor(
+             assert len(result[-1]) == len(original_data) % 10240
+         assert b"".join(result) == original_data
+ 
++    @pytest.mark.timeout(LONG_TIMEOUT)
++    @pytest.mark.parametrize(
++        "data",
++        [d[1] for d in _test_compressor_params],
++        ids=[d[0] for d in _test_compressor_params],
++    )
++    def test_read_chunked_with_trailing_data_does_not_hang(
++        self,
++        request: pytest.FixtureRequest,
++        data: tuple[str, typing.Callable[[bytes], bytes]] | None,
++    ) -> None:
++        if data is None:
++            pytest.skip(f"Proper {request.node.callspec.id} decoder is not available")
++        # The decoded body must fill multiple bounded reads so EOF is reached
++        # while trailing data remains in the decoder's input buffer.
++        original_data = b"A" * 100
++        content_encoding, compress_func = data
++        compressed_data = compress_func(original_data) + b"tail"
++        httplib_r = httplib.HTTPResponse(MockSock)  # type: ignore[arg-type]
++        httplib_r.fp = MockChunkedEncodingResponse([compressed_data])  # type: ignore[assignment]
++        r = HTTPResponse(
++            httplib_r,
++            preload_content=False,
++            headers={
++                "transfer-encoding": "chunked",
++                "content-encoding": content_encoding,
++            },
++        )
++
++        stream = r.stream(len(original_data) // 2, decode_content=True)
++        if content_encoding in ("br", "zstd"):
++            with pytest.raises(DecodeError):
++                list(stream)
++        else:
++            assert b"".join(stream) == original_data
++
+     @pytest.mark.parametrize(
+         "delta",
+         (
diff --git a/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb b/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb
index ad5dd190d8..73bfd36974 100644
--- a/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb
+++ b/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb
@@ -8,6 +8,8 @@  SRC_URI += "file://CVE-2026-44431.patch \
             file://CVE-2026-44432.patch \
             file://CVE-2026-97687_p1.patch \
             file://CVE-2026-97687_p2.patch \
+            file://CVE-2026-97688.patch \
+            file://CVE-2026-97688-regression.patch \
            "
 SRC_URI[sha256sum] = "1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed"