urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.
CVSS Details
- CVSS 4.0 Base Score: 8.9 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fence-agents-ilo-sshUpgrade ha-cloud-supportUpgrade fence-agents-vmware-restUpgrade fence-agents-hpbladeUpgrade fence-agents-brocadeUpgrade resource-agents-gcpUpgrade fence-agents-redfishUpgrade python3-urllib3Upgrade fence-agents-intelmodularUpgrade fence-virtd-libvirtUpgrade fence-agents-vmware-soapUpgrade fence-agents-ipmilanUpgrade fence-agents-allUpgrade fence-agents-mpathUpgrade fence-agents-bladecenterUpgrade fence-agents-ilo-mpUpgrade fence-virtUpgrade fence-agents-kubevirtUpgrade fence-agents-zvmUpgrade fence-agents-wtiUpgrade fence-agents-lparUpgrade fence-agents-aliyunUpgrade fence-agents-ibmbladeUpgrade fence-agents-gceUpgrade fence-agents-cisco-mdsUpgrade python3.12-urllib3Upgrade fence-agents-scsiUpgrade fence-virtd-serialUpgrade fence-agents-ifmibUpgrade fence-agents-ipduUpgrade fence-agents-heuristics-pingUpgrade fence-agents-apcUpgrade resource-agents-pafUpgrade fence-agents-emersonUpgrade fence-agents-ilo2Upgrade fence-virtdUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-computeUpgrade resource-agentsUpgrade fence-agents-ibm-vpcUpgrade fence-agents-rhevmUpgrade fence-agents-rsaUpgrade fence-virtd-multicastUpgrade fence-agents-awsUpgrade fence-agents-epsUpgrade fence-agents-apc-snmpUpgrade fence-agents-azure-armUpgrade fence-agents-drac5Upgrade fence-virtd-cpgUpgrade fence-agents-cisco-ucsUpgrade fence-agents-amt-wsUpgrade fence-agents-sbdUpgrade fence-agents-ilo-moonshotUpgrade python3.11-urllib3Upgrade fence-agents-openstackUpgrade fence-virtd-tcpUpgrade fence-agents-rsbUpgrade resource-agents-aliyunUpgrade fence-agents-eaton-snmpUpgrade fence-agents-commonUpgrade fence-agents-kdumpUpgrade fence-agents-ibm-powervsUpgrade fence-agents-virsh | Jan 28, 2026 | Jan 26, 2026 |
| Alpine Linux | — | Upgrade py3-urllib3 | Jan 26, 2026 | Dec 5, 2025 |
| Amazon Linux Ami 2 | — | Upgrade python-urllib3Upgrade python-pip-wheelUpgrade python3-pipUpgrade python3-urllib3Upgrade python2-pip | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade python-urllib3 | Dec 29, 2025 | Dec 29, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-urllib3 | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-urllib3 | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-urllib3 | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-urllib3 | Mar 10, 2026 | Mar 10, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Apr 8, 2026 |
| Oracle_linux | — | Upgrade fence-agents-rsbUpgrade fence-agents-ilo2Upgrade fence-virtd-tcpUpgrade fence-agents-bladecenterUpgrade fence-agents-azure-armUpgrade fence-agents-eaton-snmpUpgrade fence-agents-redfishUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-cisco-mdsUpgrade fence-agents-epsUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-cisco-ucsUpgrade fence-virtd-cpgUpgrade python3.12-urllib3Upgrade fence-agents-hpbladeUpgrade fence-agents-mpathUpgrade fence-agents-drac5Upgrade fence-agents-kdumpUpgrade fence-agents-wtiUpgrade fence-agents-lparUpgrade fence-agents-computeUpgrade fence-virtd-serialUpgrade fence-agents-rsaUpgrade fence-agents-vmware-restUpgrade fence-virtdUpgrade fence-agents-ibm-vpcUpgrade fence-agents-commonUpgrade fence-agents-ibm-powervsUpgrade fence-agents-amt-wsUpgrade fence-agents-ifmibUpgrade fence-agents-allUpgrade python3-urllib3Upgrade fence-virtd-libvirtUpgrade fence-agents-vmware-soapUpgrade fence-agents-virshUpgrade fence-agents-openstackUpgrade fence-agents-awsUpgrade fence-agents-scsiUpgrade python3.11-urllib3Upgrade fence-agents-emersonUpgrade fence-agents-ipmilanUpgrade fence-agents-heuristics-pingUpgrade fence-agents-gceUpgrade fence-virtUpgrade fence-agents-rhevmUpgrade fence-agents-apcUpgrade fence-agents-sbdUpgrade fence-agents-ilo-mpUpgrade fence-agents-intelmodularUpgrade fence-agents-apc-snmpUpgrade ha-cloud-supportUpgrade fence-agents-brocadeUpgrade fence-agents-ipduUpgrade fence-agents-kubevirtUpgrade fence-agents-ilo-sshUpgrade resource-agentsUpgrade fence-virtd-multicastUpgrade fence-agents-aliyunUpgrade fence-agents-ibmblade | Jan 27, 2026 | Dec 5, 2025 |
| Redhat_linux | — | Upgrade fence-virtd-serialUpgrade fence-agents-cisco-ucsUpgrade python3-urllib3Upgrade resource-agents-aliyunUpgrade fence-virtd-tcp-debuginfoUpgrade fence-virtd-libvirtUpgrade fence-agents-brocadeUpgrade resource-agents-sap-hanaUpgrade resource-agents-debuginfoUpgrade fence-agents-gceUpgrade sap-cluster-connectorUpgrade fence-agents-heuristics-pingUpgrade fence-agents-awsUpgrade fence-agents-nutanix-ahvUpgrade resource-agents-pafUpgrade python3.11-urllib3Upgrade fence-agents-ibm-powervsUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-agents-ibm-vpcUpgrade fence-agents-ifmibUpgrade fence-virtd-debuginfoUpgrade fence-agents-kdumpUpgrade fence-virtd-cpgUpgrade fence-agents-ipduUpgrade fence-virtdUpgrade fence-agents-kdump-debuginfoUpgrade fence-agents-rhevmUpgrade fence-agents-rsbUpgrade fence-agents-kubevirtUpgrade fence-agents-ilo-sshUpgrade fence-agents-computeNo solution existsUpgrade fence-agents-apc-snmpUpgrade fence-virtd-cpg-debuginfoUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-agents-debuginfoUpgrade fence-agents-debugsourceUpgrade fence-virtUpgrade fence-agents-wtiUpgrade fence-agents-ipmilanUpgrade ha-cloud-support-debuginfoUpgrade fence-agents-aliyun-debuginfoUpgrade fence-virtd-multicast-debuginfoUpgrade fence-agents-ibmbladeUpgrade fence-agents-lparUpgrade fence-agents-openstackUpgrade fence-virtd-multicastUpgrade resource-agentsUpgrade fence-virt-debuginfoUpgrade python-s3transferUpgrade fence-agents-virshUpgrade resource-agents-aliyun-debuginfoUpgrade fence-agents-scsiUpgrade fence-agents-redfishUpgrade fence-agents-amt-wsUpgrade fence-agents-sbdUpgrade fence-agents-intelmodularUpgrade fence-agents-ilo-mpUpgrade fence-agents-bladecenterUpgrade fence-virtd-tcpUpgrade resource-agents-sap-hana-scaleoutUpgrade fence-agents-azure-armUpgrade fence-agents-eaton-snmpUpgrade fence-agents-epsUpgrade fence-agents-mpathUpgrade ha-cloud-supportUpgrade fence-agents-cisco-mdsUpgrade fence-agents-rsaUpgrade resource-agents-sapUpgrade fence-agents-apcUpgrade fence-virtd-serial-debuginfoUpgrade fence-agents-vmware-soapUpgrade fence-agents-drac5Upgrade fence-agents-hpbladeUpgrade fence-agents-aliyunUpgrade fence-agents-ilo2Upgrade fence-agents-vmware-restUpgrade fence-agents-emersonUpgrade fence-agents-zvmUpgrade python3.12-urllib3Upgrade fence-agents-allUpgrade fence-agents-commonUpgrade resource-agents-debugsourceUpgrade fence-agents-ilo-moonshotUpgrade resource-agents-gcpUpgrade fence-agents-azure-arm-debuginfo | Jan 28, 2026 | Dec 5, 2025 |
| Rocky_linux | — | Upgrade fence-virtd-serialUpgrade fence-virtd-serial-debuginfoUpgrade fence-virtd-libvirtUpgrade fence-agents-kubevirtUpgrade ha-cloud-supportUpgrade fence-virtd-tcpUpgrade resource-agents-aliyun-debuginfoUpgrade resource-agents-debugsourceUpgrade fence-agents-allUpgrade fence-agents-aliyunUpgrade fence-agents-gceUpgrade fence-virt-debuginfoUpgrade fence-agents-azure-arm-debuginfoUpgrade fence-agents-kdump-debuginfoUpgrade fence-agents-debuginfoUpgrade resource-agents-gcpUpgrade fence-agents-azure-armUpgrade fence-agents-zvmUpgrade fence-virtd-multicast-debuginfoUpgrade fence-agents-redfishUpgrade fence-virtd-multicastUpgrade fence-agents-awsUpgrade resource-agents-aliyunUpgrade fence-virtUpgrade resource-agents-pafUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-agents-openstackUpgrade fence-virtd-debuginfoUpgrade resource-agents-debuginfoUpgrade fence-virtd-cpgUpgrade fence-virtd-cpg-debuginfoUpgrade fence-agents-kubevirt-debuginfoUpgrade ha-cloud-support-debuginfoUpgrade fence-virtd-tcp-debuginfoUpgrade fence-agents-kdumpUpgrade fence-agents-debugsourceUpgrade fence-agents-computeUpgrade resource-agentsUpgrade fence-virtdUpgrade fence-agents-aliyun-debuginfo | Feb 13, 2026 | Feb 11, 2026 |
| Ubuntu | — | Upgrade python3-pip (Ubuntu Pro)Upgrade python3-urllib3Upgrade python3-pip-whl (Ubuntu Pro)Upgrade python-pip (Ubuntu Pro)Upgrade python3-urllib3 (Ubuntu Pro)Upgrade python-pip-whl (Ubuntu Pro) | Dec 12, 2025 | Dec 5, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub