diff --git a/.gitignore b/.gitignore
index 992ae29..d81c293 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/urllib3-1.26.18.tar.gz
+SOURCES/urllib3-1.26.19.tar.gz
diff --git a/.python3.12-urllib3.metadata b/.python3.12-urllib3.metadata
index 9d6125a..5071c4d 100644
--- a/.python3.12-urllib3.metadata
+++ b/.python3.12-urllib3.metadata
@@ -1 +1 @@
-bffc545083d4fe74a6ce953599c0c2c7012b1833 SOURCES/urllib3-1.26.18.tar.gz
+05ec9b41b14659fd4350c8a220e1d31e79169e5a SOURCES/urllib3-1.26.19.tar.gz
diff --git a/SPECS/python3.12-urllib3.spec b/SPECS/python3.12-urllib3.spec
index ec7a517..c9f6d45 100644
--- a/SPECS/python3.12-urllib3.spec
+++ b/SPECS/python3.12-urllib3.spec
@@ -5,8 +5,8 @@
 %bcond_with tests
 
 Name:           python%{python3_pkgversion}-urllib3
-Version:        1.26.18
-Release:        2%{?dist}
+Version:        1.26.19
+Release:        1%{?dist}
 Summary:        HTTP library with thread-safe connection pooling, file post, and more
 
 # SPDX
@@ -130,6 +130,10 @@ ignore="${ignore-} --ignore=test/test_no_ssl.py"
 
 
 %changelog
+* Wed Sep 25 2024 Lumír Balhar <lbalhar@redhat.com> - 1.26.19-1
+- Rebase to 1.26.19 to fix CVE-2024-37891
+Resolves: RHEL-59989
+
 * Tue Jan 23 2024 Miro Hrončok <mhroncok@redhat.com> - 1.26.18-2
 - Rebuilt for timestamp .pyc invalidation mode