CVE-2026-21441 — Python Urllib3 vulnerability

Vendor	Product	Version range	Fixed in
debian	python-urllib3	< python-urllib3 1.26.12-1+deb12u3 (bookworm)	python-urllib3 1.26.12-1+deb12u3 (bookworm)
python	urllib3	>= 1.22 < 2.6.3	2.6.3
urllib3	urllib3	—	—
urllib3	urllib3	>= 1.22 < 2.6.3	2.6.3

Ubuntu

pip vulnerabilities

vendor_ubuntu·2026-02-04

CVE-2025-66418 pip vulnerabilities Title: pip vulnerabilities Summary: Several security issues were fixed in pip. Several security issues were discovered in the libraries bundled in pip. An attacker could possibly use these issues to perform a variety of attacks, such as denial of service or arbitrary code execution. Instructions: In general, a standard system update will make all the necessary changes.

Ubuntu

urllib3 regression

vendor_ubuntu·2026-01-19

CVE-2026-21441 urllib3 regression Title: urllib3 regression Summary: USN-7955-1 introduced a regression in urllib3 USN-7955-1 fixed vulnerabilities in urllib3. The update introduced a regression in response streaming on Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that urllib3 incorrectly handled decompression during HTTP redirects. An attacker could possibly use this issue to cause urllib3 to use excessive resources, causing a denial of service. Instructions: In general, a standard system update will make all the necessary changes.

Ubuntu

urllib3 vulnerability

vendor_ubuntu·2026-01-12

CVE-2026-21441 urllib3 vulnerability Title: urllib3 vulnerability Summary: urllib3 could be made to use excessive resources if it received specially crafted network traffic. It was discovered that urllib3 incorrectly handled decompression during HTTP redirects. An attacker could possibly use this issue to cause urllib3 to use excessive resources, causing a denial of service. Instructions: In general, a standard system update will make all the necessary changes.

Red Hat

urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

vendor_redhat·2026-01-07·CVSS 8.9

CVE-2026-21441 [HIGH] CWE-409 urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This

Debian

CVE-2026-21441: python-urllib3 - urllib3 is an HTTP client library for Python. urllib3's streaming API is designe...

vendor_debian·2026·CVSS 8.9

CVE-2026-21441 [HIGH] CVE-2026-21441: python-urllib3 - urllib3 is an HTTP client library for Python. urllib3's streaming API is designe... urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the

VulDB

urllib3 up to 2.6.2 Streaming API preload_content Content-Encoding data amplification (GHSA-38jv-5279-wg99 / EUVD-2026-1188)

vuldb·2026-05-03·CVSS 8.9

CVE-2026-21441 [HIGH] urllib3 up to 2.6.2 Streaming API preload_content Content-Encoding data amplification (GHSA-38jv-5279-wg99 / EUVD-2026-1188) A vulnerability marked as problematic has been reported in urllib3 up to 2.6.2. Affected is the function preload_content of the component Streaming API. Performing a manipulation of the argument Content-Encoding results in highly compressed data. This vulnerability is reported as CVE-2026-21441. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

GHSA

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

ghsa·2026-01-07

CVE-2026-21441 [HIGH] CWE-409 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) ### Impact urllib3's [streaming API](https://urllib3.readthedocs.io/en/2.6.2/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. However, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred

OSV

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

osv·2026-01-07

CVE-2026-21441 [HIGH] Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) ### Impact urllib3's [streaming API](https://urllib3.readthedocs.io/en/2.6.2/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. However, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred

OSV

CVE-2026-21441: urllib3 is an HTTP client library for Python

osv·2026-01-07·CVSS 8.9

CVE-2026-21441 [HIGH] CVE-2026-21441: urllib3 is an HTTP client library for Python urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the

CVE-2026-21441: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in…

Affected

CVSS provenance