vulnerability
Ubuntu: (Multiple Advisories) (CVE-2025-66418): urllib3 vulnerabilities
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:L/Au:N/C:N/I:N/A:C) | Dec 5, 2025 | Dec 12, 2025 | Feb 6, 2026 |
Description
Illia Volochii discovered that urllib3 did not limit the steps in a
decompression chain. An attacker could possibly use this issue to cause
urllib3 to use excessive resources, causing a denial of service.
(CVE-2025-66418)
Rui Xi discovered that urllib3 incorrectly handled highly compressed data.
An attacker could possibly use this issue to cause urllib3 to use excessive
resources, causing a denial of service. This issue only affected Ubuntu
24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-66471)
For the brotli encoding, the fix for CVE-2025-66471 requires an additional
security update in the brotli package.
Solutions
References
- CVE-2025-66418
- https://attackerkb.com/topics/CVE-2025-66418
- CWE-770
- UBUNTU-USN-7927-1
- UBUNTU-USN-8010-1
- URL-https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53
- URL-https://ubuntu.com/security/notices/USN-7927-1
- URL-https://www.cve.org/CVERecord?id=CVE-2025-66418
- URL-https://www.openwall.com/lists/oss-security/2025/12/05/4
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.