RHOAIENG-63872: CVE-2026-44432 rhoai/odh-training-cuda121-torch24-py311-rhel9: urllib3: Denial of Service due to excessive HTTP response decompression [rhoai-3.3]

[jira-autofix]

Fixes CVE-2026-44432 (DoS via excessive HTTP response decompression)
by raising the urllib3 lower bound from 1.15.1/1.21.1 to 2.7.0 in
the Python SDK setup.py and XGBoost example requirements.

Summary by CodeRabbit

• Chores
  • Updated urllib3 requirement to 2.7.0 or later across the SDK and example packages to standardize dependency versions.
  • Removed an explicit urllib3 constraint from one example to rely on the consolidated SDK requirement, reducing version conflicts.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: d48f5f0d-63ea-42bb-9dc4-4f68d6cf616c

📥 Commits

Reviewing files that changed from the base of the PR and between 53f1ffc and 4945108.

📒 Files selected for processing (2)

• examples/xgboost/smoke-dist/requirements.txt
• examples/xgboost/xgboost-dist/requirements.txt

💤 Files with no reviewable changes (2)

• examples/xgboost/xgboost-dist/requirements.txt
• examples/xgboost/smoke-dist/requirements.txt

---

📝 Walkthrough

Walkthrough

The pull request updates urllib3 constraints: sdk/python/setup.py now requires urllib3>=2.7.0 (was >=1.15.1); examples/xgboost/smoke-dist/requirements.txt updates urllib3 to >=2.7.0 (was >=1.21.1); examples/xgboost/xgboost-dist/requirements.txt removes the urllib3 entry entirely. No code or public API entities were changed.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

---

Security considerations

• Confirm the version bump to urllib3>=2.7.0 is intentional and documents the security justification (e.g., fixes in 2.7.0 or mitigation for known CVEs such as CVE-2024-37891). Cite the specific CVE(s) in the PR/commit message.
• Verify compatibility: run dependency resolution and test suites to ensure no transitive dependency conflicts or runtime breakage from urllib3 2.x (breaking changes from 1.x → 2.x).
• If xgboost-dist intentionally removed urllib3, confirm that runtime consumers still receive a supported urllib3 via transitive deps or application requirements; otherwise add an explicit constraint.
• Check for CWE-relevant issues: ensure that HTTP client usage across the repo handles TLS validation and redirects properly (see CWE-295, CWE-829) when upgrading urllib3.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: upgrading urllib3 to address CVE-2026-44432, a DoS vulnerability via HTTP response decompression.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@examples/xgboost/smoke-dist/requirements.txt`:
- Line 4: The requirements file currently pins urllib3>=2.7.0 which misleadingly
suggests an unavoidable conflict with legacy requests; update
examples/xgboost/smoke-dist/requirements.txt by removing the explicit
urllib3>=2.7.0 constraint or change it to a range that matches the minimum
requests version you intend to support (e.g., align urllib3 with the requests
minimum such as requests>=2.21.0), and ensure the requirements list only
specifies either requests (with its compatible urllib3 range) or a compatible
urllib3 range—reference the package names "requests" and "urllib3" in the
requirements to locate the entry.

In `@sdk/python/setup.py`:
- Line 29: The PoolManager/ProxyManager calls in
sdk/python/kubeflow/training/rest.py are using urllib3 1.x-style top-level
kwargs (maxsize, cert_reqs, ca_certs, cert_file, key_file, and
proxy_url/proxy_headers) which are incompatible with urllib3 2.x constructors;
update the code that constructs urllib3.PoolManager and urllib3.ProxyManager to
move TLS and pool settings into the connection_pool_kw dict (e.g., pass maxsize,
cert_reqs, ca_certs, cert_file, key_file inside connection_pool_kw) and call
ProxyManager with the proxy URL as the first positional argument (and proxy
headers via proxy_headers or connection_pool_kw per urllib3 2.x), ensuring the
code paths in rest.py that create these managers conform to urllib3>=2.7.0
signatures.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 26cdb21c-dfa4-4032-8204-ab1c7b22e60d

📥 Commits

Reviewing files that changed from the base of the PR and between 0e38ed2 and 53f1ffc.

📒 Files selected for processing (3)

• examples/xgboost/smoke-dist/requirements.txt
• examples/xgboost/xgboost-dist/requirements.txt
• sdk/python/setup.py