urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.
CVSS Details
- CVSS 4.0 Base Score: 8.9 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3.12-urllib3Upgrade fence-agents-scsiUpgrade ha-cloud-supportUpgrade fence-agents-commonUpgrade fence-agents-epsUpgrade fence-agents-rsaUpgrade fence-agents-apcUpgrade fence-agents-aliyunUpgrade fence-agents-hpbladeUpgrade resource-agentsUpgrade fence-agents-mpathUpgrade fence-agents-allUpgrade fence-agents-ilo-mpUpgrade fence-agents-eaton-snmpUpgrade fence-agents-bladecenterUpgrade fence-agents-vmware-restUpgrade fence-virtd-tcpUpgrade fence-agents-ilo2Upgrade fence-agents-vmware-soapUpgrade fence-agents-drac5Upgrade fence-agents-rhevmUpgrade fence-agents-cisco-mdsUpgrade fence-agents-azure-armUpgrade resource-agents-gcpUpgrade fence-agents-intelmodularUpgrade fence-agents-redfishUpgrade fence-agents-sbdUpgrade fence-agents-zvmUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-amt-wsUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-ifmibUpgrade fence-virtd-serialUpgrade fence-virtUpgrade fence-virtd-libvirtUpgrade fence-agents-ipduUpgrade fence-agents-wtiUpgrade fence-agents-kdumpUpgrade fence-agents-computeUpgrade fence-agents-ibm-powervsUpgrade fence-agents-ipmilanUpgrade fence-agents-ilo-sshUpgrade python3.11-urllib3Upgrade fence-virtdUpgrade fence-agents-apc-snmpUpgrade fence-agents-heuristics-pingUpgrade fence-agents-virshUpgrade resource-agents-aliyunUpgrade fence-virtd-multicastUpgrade fence-agents-kubevirtUpgrade fence-agents-emersonUpgrade fence-agents-lparUpgrade python3-urllib3Upgrade fence-agents-awsUpgrade resource-agents-pafUpgrade fence-agents-cisco-ucsUpgrade fence-virtd-cpgUpgrade fence-agents-ibmbladeUpgrade fence-agents-ibm-vpcUpgrade fence-agents-openstackUpgrade fence-agents-gceUpgrade fence-agents-brocadeUpgrade fence-agents-rsb | Jan 28, 2026 | Jan 26, 2026 |
| Alpine Linux | — | Upgrade py3-urllib3 | Jan 26, 2026 | Dec 5, 2025 |
| Amazon Linux Ami 2 | — | Upgrade python-urllib3Upgrade python2-pipUpgrade python3-pipUpgrade python3-urllib3Upgrade python-pip-wheel | May 20, 2026 | May 20, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-urllib3 | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-urllib3 | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-urllib3 | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-urllib3 | Mar 10, 2026 | Mar 10, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Apr 8, 2026 |
| Redhat_linux | — | Upgrade fence-agents-cisco-mdsUpgrade fence-agents-openstackUpgrade fence-agents-ipmilanUpgrade resource-agents-aliyun-debuginfoUpgrade fence-agents-debuginfoUpgrade fence-agents-ilo-mpUpgrade fence-agents-ipduUpgrade fence-agents-allUpgrade resource-agentsUpgrade fence-agents-aliyunUpgrade fence-agents-apcUpgrade resource-agents-sap-hanaUpgrade fence-agents-gceUpgrade fence-agents-azure-armUpgrade fence-agents-eaton-snmpUpgrade fence-agents-rhevmUpgrade ha-cloud-supportUpgrade fence-agents-brocadeUpgrade fence-agents-emersonUpgrade fence-virtd-tcpUpgrade fence-virtd-libvirtUpgrade fence-agents-ifmibUpgrade fence-agents-vmware-restUpgrade fence-agents-ilo-sshUpgrade fence-agents-vmware-soapUpgrade python-urllib3Upgrade python-s3transferUpgrade fence-virtd-multicastUpgrade python3-urllib3Upgrade sap-cluster-connectorUpgrade fence-agents-amt-wsUpgrade fence-agents-bladecenterUpgrade fence-agents-apc-snmpUpgrade fence-agents-heuristics-pingUpgrade fence-agents-zvmUpgrade fence-agents-scsiUpgrade fence-virtd-debuginfoUpgrade fence-virtd-serial-debuginfoUpgrade resource-agents-debugsourceUpgrade resource-agents-pafUpgrade fence-agents-hpbladeUpgrade fence-agents-ibmbladeUpgrade fence-agents-intelmodularUpgrade fence-agents-kubevirtUpgrade fence-agents-sbdUpgrade fence-agents-kdumpUpgrade fence-virt-debuginfoUpgrade python3.12-urllib3Upgrade fence-agents-virshUpgrade ha-cloud-support-debuginfoUpgrade fence-virtUpgrade python3.11-urllib3Upgrade fence-agents-awsUpgrade fence-agents-rsbUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-agents-ibm-powervsUpgrade fence-agents-redfishUpgrade resource-agents-sap-hana-scaleoutUpgrade fence-agents-epsUpgrade fence-virtdUpgrade fence-virtd-serialUpgrade fence-agents-computeUpgrade fence-agents-debugsourceNo solution existsUpgrade fence-agents-ibm-vpcUpgrade fence-agents-lparUpgrade fence-virtd-tcp-debuginfoUpgrade fence-agents-wtiUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-nutanix-ahvUpgrade fence-virtd-cpgUpgrade resource-agents-gcpUpgrade fence-agents-cisco-ucsUpgrade resource-agents-debuginfoUpgrade resource-agents-aliyunUpgrade fence-virtd-cpg-debuginfoUpgrade fence-agents-kdump-debuginfoUpgrade fence-agents-azure-arm-debuginfoUpgrade fence-agents-rsaUpgrade fence-agents-ilo2Upgrade fence-virtd-multicast-debuginfoUpgrade fence-agents-mpathUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-agents-drac5Upgrade fence-agents-aliyun-debuginfoUpgrade resource-agents-sapUpgrade fence-agents-common | Feb 12, 2026 | Dec 5, 2025 |
| Rocky_linux | — | Upgrade fence-agents-debuginfoUpgrade fence-virt-debuginfoUpgrade resource-agents-aliyun-debuginfoUpgrade fence-virtd-multicast-debuginfoUpgrade resource-agents-gcpUpgrade fence-virtd-serialUpgrade resource-agents-pafUpgrade fence-virtd-serial-debuginfoUpgrade fence-virtd-multicastUpgrade resource-agents-aliyunUpgrade fence-agents-zvmUpgrade fence-agents-debugsourceUpgrade fence-virtd-libvirt-debuginfoUpgrade resource-agents-debugsourceUpgrade resource-agentsUpgrade fence-agents-awsUpgrade fence-virtUpgrade ha-cloud-supportUpgrade fence-agents-openstackUpgrade resource-agents-debuginfoUpgrade fence-virtd-cpgUpgrade fence-virtd-tcpUpgrade fence-agents-aliyunUpgrade fence-agents-azure-armUpgrade fence-virtd-debuginfoUpgrade fence-agents-redfishUpgrade fence-agents-azure-arm-debuginfoUpgrade fence-virtdUpgrade fence-agents-allUpgrade fence-agents-kdump-debuginfoUpgrade fence-agents-computeUpgrade fence-agents-gceUpgrade fence-agents-aliyun-debuginfoUpgrade fence-agents-kubevirt-debuginfoUpgrade ha-cloud-support-debuginfoUpgrade fence-agents-kdumpUpgrade fence-agents-kubevirtUpgrade fence-virtd-libvirtUpgrade fence-virtd-tcp-debuginfoUpgrade fence-virtd-cpg-debuginfo | Feb 13, 2026 | Feb 11, 2026 |
| Ubuntu | — | Upgrade python3-pip (Ubuntu Pro)Upgrade python3-pip-whl (Ubuntu Pro)Upgrade python3-urllib3 | Dec 12, 2025 | Dec 5, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub