Описание
urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (preload_content=False) when using Brotli support. The issue arises due to three independent code paths in response.py that bypass the max_length protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative max_length values can be produced due to buffer arithmetic in read(), flush_decoder unconditionally overrides max_length to -1, and _flush_decoder() passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using requests or urllib3 to stream content from untrusted sources.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | deferred | 2026-07-07 |
| esm-apps-legacy/xenial | deferred | 2026-07-07 |
| esm-apps/bionic | deferred | 2026-07-07 |
| esm-apps/focal | deferred | 2026-07-07 |
| esm-apps/jammy | deferred | 2026-07-07 |
| esm-apps/noble | deferred | 2026-07-07 |
| esm-apps/resolute | deferred | 2026-07-07 |
| esm-infra-legacy/trusty | deferred | 2026-07-07 |
| jammy | deferred | 2026-07-07 |
| noble | deferred | 2026-07-07 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | deferred | 2026-07-07 |
| esm-infra-legacy/trusty | deferred | 2026-07-07 |
| esm-infra-legacy/xenial | deferred | 2026-07-07 |
| esm-infra/bionic | deferred | 2026-07-07 |
| esm-infra/focal | deferred | 2026-07-07 |
| jammy | deferred | 2026-07-07 |
| noble | deferred | 2026-07-07 |
| questing | ignored | end of life, was deferred [2026-07-07] |
| resolute | deferred | 2026-07-07 |
| upstream | released | 2.7.0-1 |
Показывать по
7.5 High
CVSS3
Связанные уязвимости
urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.
urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in ...
urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.
7.5 High
CVSS3