CVE-2025-66471
published 2025-12-05CVE-2025-66471: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.63%
46.3th percentile
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-urllib3 | < python-urllib3 2.6.3-1 (forky) | python-urllib3 2.6.3-1 (forky) |
| msrc | azl3_python-urllib3_2.0.7-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-9_on_azure_linux_3.0 | — | — |
| msrc | cbl2_python-urllib3_1.26.19-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-urllib3_1.26.19-3_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-virtualenv_20.26.6-2_on_cbl_mariner_2.0 | — | — |
| python | urllib3 | >= 1.0 < 2.6.0 | 2.6.0 |
| ubuntu | python-pip | — | — |
| urllib3 | urllib3 | >= 1.0 < 2.6.0 | 2.6.0 |
| urllib3 | urllib3_urllib3 | >= unspecified < 2.7.0 | 2.7.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.9HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv8.9HIGH
vendor_debian8.9HIGH
vendor_msrc8.9HIGH
vendor_redhat8.9HIGH
vendor_ubuntu8.9HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
pip vulnerability
vendor_ubuntu·2026-06-03·CVSS 8.9
CVE-2025-66471 [HIGH] pip vulnerability
Title: pip vulnerability
Summary: A regression was fixed in pip.
USN-8344-1 introduced a regression in pip. This update provides a complete fix for this issue..
We apologize for the inconvenience.
Original advisory details:
It was discovered that pip's bundled urllib3 library improperly
handled streaming decompression of highly compressed data. A remote
attacker could possibly use this issue to cause pip to consume excessive resources,
leading to a denial of service. (CVE-2025-66471)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
pip regression
vendor_ubuntu·2026-05-29·CVSS 5.6
CVE-2024-35195 [MEDIUM] pip regression
Title: pip regression
Summary: USN-8344-1 introduced a regression in pip.
USN-8344-1 fixed vulnerabilities in pip. On Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,
and Ubuntu 26.04 LTS the patches for CVE-2025-66471 caused a regression when
using pip. The patches for CVE-2025-66471 have been temporarily reverted
pending investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that pip incorrectly handled TLS certificate
verification in session connections. If a session was first used with
certificate verification disabled, subsequent requests to the same host
would also skip verification regardless of the session's current settings.
A remote attacker could possibly use this issue to perform a machine-in-the-middle
attack and expose sensitive information. (
Ubuntu
pip vulnerabilities
vendor_ubuntu·2026-05-28·CVSS 5.6
CVE-2025-66418 [MEDIUM] pip vulnerabilities
Title: pip vulnerabilities
Summary: Several security issues were fixed in pip.
It was discovered that pip incorrectly handled TLS certificate
verification in session connections. If a session was first used with
certificate verification disabled, subsequent requests to the same host
would also skip verification regardless of the session's current settings.
A remote attacker could possibly use this issue to perform a machine-in-the-middle
attack and expose sensitive information. (CVE-2024-35195)
It was discovered that pip's bundled urllib3 library did not limit the
number of decompression steps when processing HTTP responses. A remote
attacker could possibly use this issue to cause pip to consume excessive resources,
leading to a denial of service. (CVE-2025-66418)
It was discovered tha
Ubuntu
urllib3 regression
vendor_ubuntu·2026-01-13·CVSS 7.5
CVE-2025-66471 [HIGH] urllib3 regression
Title: urllib3 regression
Summary: USN-7927-1 introduced a regression in urllib3
USN-7927-1 fixed vulnerabilities in urllib3. The update for CVE-2025-66471
introduced a regression in urllib3 when decompressing zstd data. This
update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Illia Volochii discovered that urllib3 did not limit the steps in a
decompression chain. An attacker could possibly use this issue to cause
urllib3 to use excessive resources, causing a denial of service.
(CVE-2025-66418)
Rui Xi discovered that urllib3 incorrectly handled highly compressed data.
An attacker could possibly use this issue to cause urllib3 to use
excessive resources, causing a denial of service. This issue only affected
Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubunt
Ubuntu
urllib3 regression
vendor_ubuntu·2026-01-12·CVSS 7.5
CVE-2025-66471 [HIGH] urllib3 regression
Title: urllib3 regression
Summary: USN-7927-1 introduced a regression in urllib3
USN-7927-1 fixed vulnerabilities in urllib3. The update for CVE-2025-66471
introduced a regression in the zstd decompression component inside urllib3.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Illia Volochii discovered that urllib3 did not limit the steps in a
decompression chain. An attacker could possibly use this issue to cause
urllib3 to use excessive resources, causing a denial of service.
(CVE-2025-66418)
Rui Xi discovered that urllib3 incorrectly handled highly compressed data.
An attacker could possibly use this issue to cause urllib3 to use
excessive resources, causing a denial of service. This issue only affected
Ubuntu 24.04 LTS, Ubuntu 25.04
Ubuntu
urllib3 vulnerabilities
vendor_ubuntu·2025-12-11·CVSS 7.5
CVE-2025-66418 [HIGH] urllib3 vulnerabilities
Title: urllib3 vulnerabilities
Summary: Several security issues were fixed in urllib3.
Illia Volochii discovered that urllib3 did not limit the steps in a
decompression chain. An attacker could possibly use this issue to cause
urllib3 to use excessive resources, causing a denial of service.
(CVE-2025-66418)
Rui Xi discovered that urllib3 incorrectly handled highly compressed data.
An attacker could possibly use this issue to cause urllib3 to use excessive
resources, causing a denial of service. This issue only affected Ubuntu
24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-66471)
For the brotli encoding, the fix for CVE-2025-66471 requires an additional
security update in the brotli package.
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
urllib3 Streaming API improperly handles highly compressed data
vendor_msrc·2025-12-09·CVSS 8.9
CVE-2025-66471 [HIGH] CWE-409 urllib3 Streaming API improperly handles highly compressed data
urllib3 Streaming API improperly handles highly compressed data
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Red Hat
urllib3: urllib3 Streaming API improperly handles highly compressed data
vendor_redhat·2025-12-05·CVSS 8.9
CVE-2025-66471 [HIGH] CWE-409 urllib3: urllib3 Streaming API improperly handles highly compressed data
urllib3: urllib3 Streaming API improperly handles highly compressed data
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for t
Debian
CVE-2025-66471: python-urllib3 - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1...
vendor_debian·2025·CVSS 8.9
CVE-2025-66471 [HIGH] CVE-2025-66471: python-urllib3 - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1...
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to ful
GHSA
urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support.
ghsa_unreviewed·2026-06-19·CVSS 7.5
CVE-2026-9375 [HIGH] CWE-400 urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support.
urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications a
OSV
python-urllib3 regression
osv·2026-01-13·CVSS 8.9
CVE-2025-66471 [HIGH] python-urllib3 regression
python-urllib3 regression
USN-7927-1 fixed vulnerabilities in urllib3. The update for CVE-2025-66471
introduced a regression in urllib3 when decompressing zstd data. This
update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Illia Volochii discovered that urllib3 did not limit the steps in a
decompression chain. An attacker could possibly use this issue to cause
urllib3 to use excessive resources, causing a denial of service.
(CVE-2025-66418)
Rui Xi discovered that urllib3 incorrectly handled highly compressed data.
An attacker could possibly use this issue to cause urllib3 to use
excessive resources, causing a denial of service. This issue only affected
Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-66471)
For the brotli encoding, the
OSV
python-urllib3 regression
osv·2026-01-12·CVSS 8.9
CVE-2025-66471 [HIGH] python-urllib3 regression
python-urllib3 regression
USN-7927-1 fixed vulnerabilities in urllib3. The update for CVE-2025-66471
introduced a regression in the zstd decompression component inside urllib3.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Illia Volochii discovered that urllib3 did not limit the steps in a
decompression chain. An attacker could possibly use this issue to cause
urllib3 to use excessive resources, causing a denial of service.
(CVE-2025-66418)
Rui Xi discovered that urllib3 incorrectly handled highly compressed data.
An attacker could possibly use this issue to cause urllib3 to use
excessive resources, causing a denial of service. This issue only affected
Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-66471)
For the brotli enc
OSV
python-urllib3 vulnerabilities
osv·2025-12-11·CVSS 8.9
CVE-2025-66418 [HIGH] python-urllib3 vulnerabilities
python-urllib3 vulnerabilities
Illia Volochii discovered that urllib3 did not limit the steps in a
decompression chain. An attacker could possibly use this issue to cause
urllib3 to use excessive resources, causing a denial of service.
(CVE-2025-66418)
Rui Xi discovered that urllib3 incorrectly handled highly compressed data.
An attacker could possibly use this issue to cause urllib3 to use excessive
resources, causing a denial of service. This issue only affected Ubuntu
24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-66471)
For the brotli encoding, the fix for CVE-2025-66471 requires an additional
security update in the brotli package.
OSV
CVE-2025-66471: urllib3 is a user-friendly HTTP client library for Python
osv·2025-12-05·CVSS 8.9
CVE-2025-66471 [HIGH] CVE-2025-66471: urllib3 is a user-friendly HTTP client library for Python
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to ful
GHSA
urllib3 streaming API improperly handles highly compressed data
ghsa·2025-12-05
CVE-2025-66471 [HIGH] CWE-409 urllib3 streaming API improperly handles highly compressed data
urllib3 streaming API improperly handles highly compressed data
### Impact
urllib3's [streaming API](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.
When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation.
The decompression logic could cause urllib3
OSV
urllib3 streaming API improperly handles highly compressed data
osv·2025-12-05
CVE-2025-66471 [HIGH] urllib3 streaming API improperly handles highly compressed data
urllib3 streaming API improperly handles highly compressed data
### Impact
urllib3's [streaming API](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.
When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation.
The decompression logic could cause urllib3
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-21441 python-urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) [fedora-42]
bugzilla·2026-01-20·CVSS 8.9
CVE-2026-21441 [HIGH] CVE-2026-21441 python-urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) [fedora-42]
CVE-2026-21441 python-urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
Per https://www.cve.org/CVERecord?id=CVE-2026-21441, this is fixed in 2.6.3 and later. Fedora 43 has 2.3.0, so it is affected. The fix is compact, but it’s hard to be confident backporting it across several releases, especially considering possible interactions with fixes for CVE-2025-66471. An update may be possible, but includes new nontrivial dependencies. See https://src.fedoraproject.org/rpms/python-urllib
Bugzilla
CVE-2025-66471 python-urllib3: urllib3 Streaming API improperly handles highly compressed data [fedora-42]
bugzilla·2026-01-20·CVSS 8.9
CVE-2025-66471 [HIGH] CVE-2025-66471 python-urllib3: urllib3 Streaming API improperly handles highly compressed data [fedora-42]
CVE-2025-66471 python-urllib3: urllib3 Streaming API improperly handles highly compressed data [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
Per https://www.cve.org/CVERecord?id=CVE-2025-66471, this is fixed in 2.6.0 and later. Fedora 43 has 2.3.0, so it is affected. The fix is probably not straightforward to backport. An update may be possible, but includes new nontrivial dependencies. See https://src.fedoraproject.org/rpms/python-urllib3/pull-request/49 for discussion.
---
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issu
Bugzilla
CVE-2025-66471 urllib3: urllib3 Streaming API improperly handles highly compressed data
bugzilla·2025-12-05·CVSS 8.9
CVE-2025-66471 [HIGH] CVE-2025-66471 urllib3: urllib3 Streaming API improperly handles highly compressed data
CVE-2025-66471 urllib3: urllib3 Streaming API improperly handles highly compressed data
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an intern
2025-12-05
Published