EUVD-2025-201421
GHSA-gm62-xv2j-4w53
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4Description
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.
Analysis
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.
Technical Context
A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users. This vulnerability is classified as Allocation of Resources Without Limits or Throttling (CWE-770).
Affected Products
Affected products: Python Urllib3
Remediation
A vendor patch is available — apply it immediately. Implement rate limiting and input validation. Use timeout mechanisms for resource-intensive operations. Deploy DDoS protection where applicable.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| upstream | needs-triage | - |
| bionic | not-affected | code not present |
| focal | released | 1.25.8-2ubuntu0.4+esm2 |
| jammy | released | 1.26.5-1~exp1ubuntu0.4 |
| trusty | not-affected | code not present |
| xenial | not-affected | code not present |
| noble | released | 2.0.7-1ubuntu0.3 |
| plucky | released | 2.3.0-2ubuntu0.2 |
| questing | released | 2.3.0-3ubuntu0.1 |
| Release | Status | Version |
|---|---|---|
| upstream | needs-triage | - |
| bionic | not-affected | code not present |
| jammy | needed | - |
| noble | needed | - |
| questing | needed | - |
| trusty | not-affected | code not present |
| xenial | not-affected | code not present |
| plucky | ignored | end of life, was needed |
| focal | released | 20.0.2-5ubuntu1.11+esm4 |
Debian
Bug #1122030| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 1.26.5-1~exp1+deb11u2 | - |
| bullseye (security) | fixed | 1.26.5-1~exp1+deb11u3 | - |
| bookworm | fixed | 1.26.12-1+deb12u2 | - |
| bookworm (security) | fixed | 1.26.12-1+deb12u3 | - |
| trixie (security), trixie | fixed | 2.3.0-3+deb13u1 | - |
| forky, sid | fixed | 2.6.3-1 | - |
| trixie | fixed | 2.3.0-3+deb13u1 | - |
| (unstable) | fixed | 2.5.0-1.1 | - |
Share
External POC / Exploit Code
Leaving vuln.today