urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.
CVSS Details
- CVSS 4.0 Base Score: 8.9 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fence-agents-amt-wsUpgrade fence-agents-cisco-ucsUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-openstackUpgrade fence-agents-ibm-powervsUpgrade fence-agents-kdumpUpgrade fence-agents-rhevmUpgrade fence-agents-azure-armUpgrade resource-agentsUpgrade fence-agents-apc-snmpUpgrade fence-agents-epsUpgrade fence-virtdUpgrade resource-agents-aliyunUpgrade fence-agents-emersonUpgrade fence-agents-virshUpgrade fence-agents-ibm-vpcUpgrade fence-agents-sbdUpgrade fence-agents-awsUpgrade fence-virtd-multicastUpgrade fence-agents-computeUpgrade fence-agents-commonUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-rsaUpgrade python3.11-urllib3Upgrade fence-virtd-tcpUpgrade fence-agents-rsbUpgrade fence-agents-ilo2Upgrade fence-virtd-cpgUpgrade fence-agents-drac5Upgrade fence-agents-eaton-snmpUpgrade fence-agents-zvmUpgrade fence-agents-kubevirtUpgrade resource-agents-gcpUpgrade python3.12-urllib3Upgrade fence-agents-scsiUpgrade fence-agents-vmware-soapUpgrade fence-agents-mpathUpgrade resource-agents-pafUpgrade fence-agents-vmware-restUpgrade fence-agents-ifmibUpgrade fence-agents-heuristics-pingUpgrade fence-agents-brocadeUpgrade fence-agents-allUpgrade fence-agents-ipmilanUpgrade fence-agents-hpbladeUpgrade fence-agents-redfishUpgrade fence-agents-cisco-mdsUpgrade fence-agents-bladecenterUpgrade fence-agents-ipduUpgrade fence-agents-apcUpgrade fence-agents-lparUpgrade fence-virtUpgrade fence-agents-intelmodularUpgrade fence-agents-wtiUpgrade fence-virtd-libvirtUpgrade fence-agents-ilo-mpUpgrade fence-agents-gceUpgrade fence-agents-ilo-sshUpgrade python3-urllib3Upgrade fence-agents-aliyunUpgrade ha-cloud-supportUpgrade fence-virtd-serialUpgrade fence-agents-ibmblade | Jan 28, 2026 | Jan 26, 2026 |
| Alpine Linux | — | Upgrade py3-urllib3 | Jan 26, 2026 | Dec 5, 2025 |
| Amazon Linux Ami 2 | — | Upgrade python-urllib3Upgrade python-pip-wheelUpgrade python3-urllib3Upgrade python3-pipUpgrade python2-pip | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade python-urllib3 | Dec 29, 2025 | Dec 29, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-urllib3 | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-urllib3 | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-urllib3 | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-urllib3 | Mar 10, 2026 | Mar 10, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Apr 8, 2026 |
| Oracle_linux | — | Upgrade fence-virtUpgrade fence-agents-openstackUpgrade resource-agentsUpgrade fence-virtd-multicastUpgrade fence-agents-aliyunUpgrade fence-agents-awsUpgrade fence-agents-virshUpgrade ha-cloud-supportUpgrade fence-agents-gceUpgrade fence-agents-allUpgrade fence-agents-scsiUpgrade fence-agents-ipduUpgrade fence-agents-ifmibUpgrade fence-agents-emersonUpgrade fence-agents-sbdUpgrade fence-agents-apc-snmpUpgrade fence-agents-ilo-sshUpgrade fence-agents-kubevirtUpgrade fence-agents-rhevmUpgrade fence-agents-ipmilanUpgrade fence-agents-heuristics-pingUpgrade fence-agents-ilo-mpUpgrade python3.11-urllib3Upgrade python3-urllib3Upgrade fence-agents-intelmodularUpgrade fence-agents-brocadeUpgrade fence-agents-ibmbladeUpgrade fence-agents-amt-wsUpgrade fence-virtd-libvirtUpgrade fence-agents-apcUpgrade fence-agents-vmware-soapUpgrade fence-agents-mpathUpgrade fence-agents-ilo2Upgrade fence-agents-eaton-snmpUpgrade fence-agents-kdumpUpgrade fence-agents-drac5Upgrade fence-agents-rsaUpgrade fence-agents-hpbladeUpgrade python3.12-urllib3Upgrade fence-virtd-serialUpgrade fence-agents-ibm-powervsUpgrade fence-agents-computeUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-cisco-mdsUpgrade fence-agents-bladecenterUpgrade fence-virtdUpgrade fence-agents-vmware-restUpgrade fence-agents-rsbUpgrade fence-agents-ibm-vpcUpgrade fence-agents-epsUpgrade fence-agents-commonUpgrade fence-virtd-tcpUpgrade fence-agents-redfishUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-azure-armUpgrade fence-agents-lparUpgrade fence-agents-wtiUpgrade fence-virtd-cpgUpgrade fence-agents-cisco-ucs | Jan 27, 2026 | Dec 5, 2025 |
| Redhat_linux | — | Upgrade python-s3transferUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-virtd-cpg-debuginfoUpgrade fence-virtd-multicast-debuginfoUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-agents-rhevmUpgrade fence-agents-rsbUpgrade fence-agents-ipmilanUpgrade fence-agents-heuristics-pingUpgrade fence-virtd-serialUpgrade python3-urllib3Upgrade python3.11-urllib3Upgrade fence-virtd-debuginfoUpgrade resource-agentsNo solution existsUpgrade fence-virtd-multicastUpgrade fence-agents-aliyun-debuginfoUpgrade ha-cloud-support-debuginfoUpgrade fence-agents-debugsourceUpgrade fence-agents-wtiUpgrade fence-agents-debuginfoUpgrade fence-virt-debuginfoUpgrade fence-virtUpgrade fence-agents-openstackUpgrade fence-agents-ibm-vpcUpgrade fence-agents-ifmibUpgrade fence-agents-ilo-sshUpgrade resource-agents-aliyunUpgrade resource-agents-sap-hanaUpgrade resource-agents-debuginfoUpgrade fence-virtd-libvirtUpgrade fence-agents-ibm-powervsUpgrade fence-agents-kdumpUpgrade fence-agents-ipduUpgrade fence-agents-kdump-debuginfoUpgrade sap-cluster-connectorUpgrade fence-agents-ibmbladeUpgrade fence-agents-lparUpgrade fence-agents-awsUpgrade fence-agents-cisco-ucsUpgrade fence-agents-apc-snmpUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-computeUpgrade fence-virtd-tcp-debuginfoUpgrade resource-agents-pafUpgrade fence-agents-gceUpgrade fence-agents-brocadeUpgrade fence-virtd-cpgUpgrade fence-virtdUpgrade fence-agents-kubevirtUpgrade fence-virtd-serial-debuginfoUpgrade fence-agents-vmware-restUpgrade fence-agents-rsaUpgrade fence-agents-eaton-snmpUpgrade fence-agents-commonUpgrade fence-agents-mpathUpgrade resource-agents-sapUpgrade fence-agents-intelmodularUpgrade ha-cloud-supportUpgrade fence-agents-epsUpgrade fence-agents-azure-armUpgrade resource-agents-sap-hana-scaleoutUpgrade fence-agents-virshUpgrade fence-agents-ilo-moonshotUpgrade resource-agents-gcpUpgrade fence-agents-ilo2Upgrade resource-agents-aliyun-debuginfoUpgrade fence-agents-sbdUpgrade fence-agents-allUpgrade fence-agents-redfishUpgrade fence-agents-amt-wsUpgrade fence-agents-scsiUpgrade fence-agents-emersonUpgrade resource-agents-debugsourceUpgrade fence-agents-bladecenterUpgrade python3.12-urllib3Upgrade fence-virtd-tcpUpgrade fence-agents-zvmUpgrade fence-agents-ilo-mpUpgrade fence-agents-azure-arm-debuginfoUpgrade fence-agents-apcUpgrade fence-agents-cisco-mdsUpgrade fence-agents-aliyunUpgrade fence-agents-hpbladeUpgrade fence-agents-vmware-soapUpgrade fence-agents-drac5 | Jan 28, 2026 | Dec 5, 2025 |
| Rocky_linux | — | Upgrade resource-agents-pafUpgrade fence-agents-openstackUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-agents-redfishUpgrade fence-agents-kdumpUpgrade fence-virtUpgrade fence-virtd-debuginfoUpgrade fence-agents-awsUpgrade resource-agentsUpgrade resource-agents-aliyunUpgrade fence-virtdUpgrade fence-agents-computeUpgrade fence-virtd-tcp-debuginfoUpgrade fence-agents-aliyun-debuginfoUpgrade fence-agents-debugsourceUpgrade fence-virtd-multicast-debuginfoUpgrade fence-virtd-multicastUpgrade fence-virtd-cpgUpgrade resource-agents-debuginfoUpgrade ha-cloud-support-debuginfoUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-virtd-cpg-debuginfoUpgrade fence-agents-debuginfoUpgrade resource-agents-debugsourceUpgrade resource-agents-aliyun-debuginfoUpgrade fence-agents-azure-armUpgrade fence-agents-kubevirtUpgrade fence-agents-azure-arm-debuginfoUpgrade fence-agents-allUpgrade ha-cloud-supportUpgrade fence-agents-zvmUpgrade fence-agents-kdump-debuginfoUpgrade fence-virtd-libvirtUpgrade fence-virtd-serial-debuginfoUpgrade fence-virtd-serialUpgrade fence-agents-aliyunUpgrade resource-agents-gcpUpgrade fence-virt-debuginfoUpgrade fence-agents-gceUpgrade fence-virtd-tcp | Feb 13, 2026 | Feb 11, 2026 |
| Ubuntu | — | Upgrade python3-pip-whl (Ubuntu Pro)Upgrade python-pip (Ubuntu Pro)Upgrade python3-urllib3 (Ubuntu Pro)Upgrade python-pip-whl (Ubuntu Pro)Upgrade python3-urllib3Upgrade python3-pip (Ubuntu Pro) | Dec 12, 2025 | Dec 5, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub