CVE-2025-66418
published 2025-12-05CVE-2025-66418: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.63%
46.3th percentile
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-urllib3 | < python-urllib3 1.26.12-1+deb12u2 (bookworm) | python-urllib3 1.26.12-1+deb12u2 (bookworm) |
| msrc | azl3_python-urllib3_2.0.7-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-9_on_azure_linux_3.0 | — | — |
| msrc | cbl2_python-urllib3_1.26.19-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-urllib3_1.26.19-3_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-virtualenv_20.26.6-2_on_cbl_mariner_2.0 | — | — |
| python | urllib3 | >= 1.24 < 2.6.0 | 2.6.0 |
| ubuntu | python-pip | — | — |
| urllib3 | urllib3 | — | — |
| urllib3 | urllib3 | >= 1.24 < 2.6.0 | 2.6.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.9HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv8.9HIGH
vendor_debian8.9HIGH
vendor_msrc8.9HIGH
vendor_redhat8.9HIGH
vendor_oracle7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
pip regression
vendor_ubuntu·2026-05-29·CVSS 5.6
CVE-2024-35195 [MEDIUM] pip regression
Title: pip regression
Summary: USN-8344-1 introduced a regression in pip.
USN-8344-1 fixed vulnerabilities in pip. On Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,
and Ubuntu 26.04 LTS the patches for CVE-2025-66471 caused a regression when
using pip. The patches for CVE-2025-66471 have been temporarily reverted
pending investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that pip incorrectly handled TLS certificate
verification in session connections. If a session was first used with
certificate verification disabled, subsequent requests to the same host
would also skip verification regardless of the session's current settings.
A remote attacker could possibly use this issue to perform a machine-in-the-middle
attack and expose sensitive information. (
Ubuntu
pip vulnerabilities
vendor_ubuntu·2026-05-28·CVSS 5.6
CVE-2025-66418 [MEDIUM] pip vulnerabilities
Title: pip vulnerabilities
Summary: Several security issues were fixed in pip.
It was discovered that pip incorrectly handled TLS certificate
verification in session connections. If a session was first used with
certificate verification disabled, subsequent requests to the same host
would also skip verification regardless of the session's current settings.
A remote attacker could possibly use this issue to perform a machine-in-the-middle
attack and expose sensitive information. (CVE-2024-35195)
It was discovered that pip's bundled urllib3 library did not limit the
number of decompression steps when processing HTTP responses. A remote
attacker could possibly use this issue to cause pip to consume excessive resources,
leading to a denial of service. (CVE-2025-66418)
It was discovered tha
Ubuntu
pip vulnerabilities
vendor_ubuntu·2026-02-04
CVE-2025-66418 pip vulnerabilities
Title: pip vulnerabilities
Summary: Several security issues were fixed in pip.
Several security issues were discovered in the libraries bundled in pip. An
attacker could possibly use these issues to perform a variety of attacks,
such as denial of service or arbitrary code execution.
Instructions: In general, a standard system update will make all the necessary changes.
Oracle
Oracle Oracle Communications Risk Matrix: Mediation Engine (urllib3) — CVE-2025-66418
vendor_oracle·2026-01-15·CVSS 7.5
CVE-2025-66418 [HIGH] Oracle Oracle Communications Risk Matrix: Mediation Engine (urllib3) — CVE-2025-66418
Oracle Oracle Communications Risk Matrix: Mediation Engine (urllib3) vulnerability
CVE: CVE-2025-66418
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2026 (JAN 2026)
Ubuntu
urllib3 regression
vendor_ubuntu·2026-01-13·CVSS 7.5
CVE-2025-66471 [HIGH] urllib3 regression
Title: urllib3 regression
Summary: USN-7927-1 introduced a regression in urllib3
USN-7927-1 fixed vulnerabilities in urllib3. The update for CVE-2025-66471
introduced a regression in urllib3 when decompressing zstd data. This
update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Illia Volochii discovered that urllib3 did not limit the steps in a
decompression chain. An attacker could possibly use this issue to cause
urllib3 to use excessive resources, causing a denial of service.
(CVE-2025-66418)
Rui Xi discovered that urllib3 incorrectly handled highly compressed data.
An attacker could possibly use this issue to cause urllib3 to use
excessive resources, causing a denial of service. This issue only affected
Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubunt
Ubuntu
urllib3 regression
vendor_ubuntu·2026-01-12·CVSS 7.5
CVE-2025-66471 [HIGH] urllib3 regression
Title: urllib3 regression
Summary: USN-7927-1 introduced a regression in urllib3
USN-7927-1 fixed vulnerabilities in urllib3. The update for CVE-2025-66471
introduced a regression in the zstd decompression component inside urllib3.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Illia Volochii discovered that urllib3 did not limit the steps in a
decompression chain. An attacker could possibly use this issue to cause
urllib3 to use excessive resources, causing a denial of service.
(CVE-2025-66418)
Rui Xi discovered that urllib3 incorrectly handled highly compressed data.
An attacker could possibly use this issue to cause urllib3 to use
excessive resources, causing a denial of service. This issue only affected
Ubuntu 24.04 LTS, Ubuntu 25.04
Ubuntu
urllib3 vulnerabilities
vendor_ubuntu·2025-12-11·CVSS 7.5
CVE-2025-66418 [HIGH] urllib3 vulnerabilities
Title: urllib3 vulnerabilities
Summary: Several security issues were fixed in urllib3.
Illia Volochii discovered that urllib3 did not limit the steps in a
decompression chain. An attacker could possibly use this issue to cause
urllib3 to use excessive resources, causing a denial of service.
(CVE-2025-66418)
Rui Xi discovered that urllib3 incorrectly handled highly compressed data.
An attacker could possibly use this issue to cause urllib3 to use excessive
resources, causing a denial of service. This issue only affected Ubuntu
24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-66471)
For the brotli encoding, the fix for CVE-2025-66471 requires an additional
security update in the brotli package.
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
urllib3 allows an unbounded number of links in the decompression chain
vendor_msrc·2025-12-09·CVSS 8.9
CVE-2025-66418 [HIGH] CWE-770 urllib3 allows an unbounded number of links in the decompression chain
urllib3 allows an unbounded number of links in the decompression chain
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Red Hat
urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion
vendor_redhat·2025-12-05·CVSS 8.9
CVE-2025-66418 [HIGH] CWE-770 urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion
urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.
A flaw was found in urllib3 Python library that could lead to a Denial of Service condition. A remote, malicious server can exploit this flaw by responding to a client request with an HTTP message that uses an excessive number of chained compression algorithms. This unlimited decompression chain causes the client system to consume a virtually un
Debian
CVE-2025-66418: python-urllib3 - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1...
vendor_debian·2025·CVSS 8.9
CVE-2025-66418 [HIGH] CVE-2025-66418: python-urllib3 - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1...
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.
Scope: local
bookworm: resolved (fixed in 1.26.12-1+deb12u2)
bullseye: resolved (fixed in 1.26.5-1~exp1+deb11u2)
forky: resolved (fixed in 2.5.0-1.1)
sid: resolved (fixed in 2.5.0-1.1)
trixie: resolved (fixed in 2.3.0-3+deb13u1)
OSV
python-urllib3 regression
osv·2026-01-13·CVSS 8.9
CVE-2025-66471 [HIGH] python-urllib3 regression
python-urllib3 regression
USN-7927-1 fixed vulnerabilities in urllib3. The update for CVE-2025-66471
introduced a regression in urllib3 when decompressing zstd data. This
update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Illia Volochii discovered that urllib3 did not limit the steps in a
decompression chain. An attacker could possibly use this issue to cause
urllib3 to use excessive resources, causing a denial of service.
(CVE-2025-66418)
Rui Xi discovered that urllib3 incorrectly handled highly compressed data.
An attacker could possibly use this issue to cause urllib3 to use
excessive resources, causing a denial of service. This issue only affected
Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-66471)
For the brotli encoding, the
OSV
python-urllib3 regression
osv·2026-01-12·CVSS 8.9
CVE-2025-66471 [HIGH] python-urllib3 regression
python-urllib3 regression
USN-7927-1 fixed vulnerabilities in urllib3. The update for CVE-2025-66471
introduced a regression in the zstd decompression component inside urllib3.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Illia Volochii discovered that urllib3 did not limit the steps in a
decompression chain. An attacker could possibly use this issue to cause
urllib3 to use excessive resources, causing a denial of service.
(CVE-2025-66418)
Rui Xi discovered that urllib3 incorrectly handled highly compressed data.
An attacker could possibly use this issue to cause urllib3 to use
excessive resources, causing a denial of service. This issue only affected
Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-66471)
For the brotli enc
OSV
python-urllib3 vulnerabilities
osv·2025-12-11·CVSS 8.9
CVE-2025-66418 [HIGH] python-urllib3 vulnerabilities
python-urllib3 vulnerabilities
Illia Volochii discovered that urllib3 did not limit the steps in a
decompression chain. An attacker could possibly use this issue to cause
urllib3 to use excessive resources, causing a denial of service.
(CVE-2025-66418)
Rui Xi discovered that urllib3 incorrectly handled highly compressed data.
An attacker could possibly use this issue to cause urllib3 to use excessive
resources, causing a denial of service. This issue only affected Ubuntu
24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-66471)
For the brotli encoding, the fix for CVE-2025-66471 requires an additional
security update in the brotli package.
OSV
urllib3 allows an unbounded number of links in the decompression chain
osv·2025-12-05
CVE-2025-66418 [HIGH] urllib3 allows an unbounded number of links in the decompression chain
urllib3 allows an unbounded number of links in the decompression chain
## Impact
urllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).
However, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.
## Affected usages
Applications and libraries using urllib3 version 2.5.0 and earlier for HTTP requests to untrusted sources unless they disable content decoding explicitly.
## Remediation
Upgrade to at least urllib3 v2.6.0 in which the library limits the number of links to 5.
If upgrading is not immediately possible, use [`preload_c
OSV
CVE-2025-66418: urllib3 is a user-friendly HTTP client library for Python
osv·2025-12-05·CVSS 8.9
CVE-2025-66418 [HIGH] CVE-2025-66418: urllib3 is a user-friendly HTTP client library for Python
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.
GHSA
urllib3 allows an unbounded number of links in the decompression chain
ghsa·2025-12-05
CVE-2025-66418 [HIGH] CWE-770 urllib3 allows an unbounded number of links in the decompression chain
urllib3 allows an unbounded number of links in the decompression chain
## Impact
urllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).
However, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.
## Affected usages
Applications and libraries using urllib3 version 2.5.0 and earlier for HTTP requests to untrusted sources unless they disable content decoding explicitly.
## Remediation
Upgrade to at least urllib3 v2.6.0 in which the library limits the number of links to 5.
If upgrading is not immediately possible, use [`preload_c
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-66418 python-urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion [fedora-42]
bugzilla·2026-01-20·CVSS 8.9
CVE-2025-66418 [HIGH] CVE-2025-66418 python-urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion [fedora-42]
CVE-2025-66418 python-urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
Per https://www.cve.org/CVERecord?id=CVE-2025-66418, this is fixed in 2.6.0 and later. Fedora 43 has 2.3.0, so it is affected. The fix is probably not straightforward to backport. An update may be possible, but includes new nontrivial dependencies. See https://src.fedoraproject.org/rpms/python-urllib3/pull-request/49 for discussion.
---
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and
Bugzilla
CVE-2025-66418 urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion
bugzilla·2025-12-05·CVSS 8.9
CVE-2025-66418 [HIGH] CVE-2025-66418 urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion
CVE-2025-66418 urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2026:1086 https://access.redhat.com/errata/RHSA-2026:1086
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2026:1087 https://access.redhat.com/errata/RHSA-2026:1087
---
2025-12-05
Published