urllib3 CVE-2026-97689

Exploitation requires that the urllib3-based client (a) consumes a response using the streaming path - HTTPResponse.stream() or HTTPResponse.read_chunked() (not the non-streaming .read(), which was already bounded to http.client._MAXLINE), and (b) connects to a server the attacker controls or can machine-in-the-middle. The malicious server must respond with 'Transfer-Encoding: chunked' and then send a very long run of bytes with no newline in the chunk-size line. No authentication (PR:N) and no local access are needed against the client, and it works against default configurations of affected versions (1.10.3 through 2.7.x). The principal LIMITING factor is the trust boundary: applications that only contact fixed, trusted endpoints are largely unexposed, whereas SSRF-prone, proxy, crawler, or webhook-fetching services that reach arbitrary URLs are realistically exposed.

This is a genuine but bounded-impact denial-of-service issue, not an RCE. The vendor CVSS 4.0 vector (8.9 High) is availability-only: VC:N/VI:N/VA:H with subsequent-system SA:H and no confidentiality or integrity impact - the elevated numeric score reflects the DoS severity, not code execution. Critically, the attack direction is inverted: this is a SERVER→CLIENT attack (a malicious or MITM HTTP server exhausts the memory of the urllib3 CLIENT process), so it is only exploitable when the victim application makes an HTTP request to attacker-influenced infrastructure. That constraint is captured by AT:P (attack requirements present) in the 4.0 vector; note that CVSS 3.1 has no AT metric, so a naive 3.1 mapping of AV:N/AC:L/PR:N/UI:N/A:H = 7.5 actually OVERSTATES exploitability by omitting the malicious-server prerequisite. No EPSS score, no CISA KEV listing, and no public exploit are present in the supplied data, so there is no evidence of active exploitation. The fix commit and GitHub Security Advisory are confirmed, which raises fix-availability confidence. Net: real priority because urllib3 is everywhere and the fix should be adopted, but the practical risk is limited to environments where clients contact untrusted servers (SSRF-adjacent flows, proxies, crawlers, webhook/callback fetchers).

A victim Python application (or any of the many libraries built on urllib3, e.g. requests) sends an HTTP request to a server the attacker controls - or an on-path attacker intercepts a response. The server replies with 'Transfer-Encoding: chunked' and then streams a very long, never-terminated chunk-size line; urllib3's streaming read path buffers the entire run without a length bound, driving memory allocation until the client process is exhausted or killed. No public exploit code is identified at time of analysis, though the fix's regression tests demonstrate the trigger.