Skip to main content

Python EUVD-2025-201421

| CVE-2025-66418 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2025-12-05 security-advisories@github.com GHSA-gm62-xv2j-4w53
Python Denial Of Service Ubuntu Debian Urllib3 Red Hat Suse
7.5
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM
qualitative
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
EUVD ID Assigned
Mar 15, 2026 - 17:08 euvd
EUVD-2025-201421
Analysis Generated
Mar 15, 2026 - 17:08 vuln.today
Patch released
Mar 15, 2026 - 17:08 nvd
Patch available
CVE Published
Dec 05, 2025 - 16:15 nvd
HIGH 7.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 19 pypi packages depend on urllib3 (19 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.24.

DescriptionGitHub Advisory

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

Analysis

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

Technical ContextAI

A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users. This vulnerability is classified as Allocation of Resources Without Limits or Throttling (CWE-770).

RemediationAI

A vendor patch is available — apply it immediately. Implement rate limiting and input validation. Use timeout mechanisms for resource-intensive operations. Deploy DDoS protection where applicable.

More from same product – last 7 days

CVE-2026-48039 CRITICAL POC
9.1 Jun 11

Unauthenticated remote attackers can invoke MCP tool handlers and exfiltrate the operator's long-lived Meta Graph API ac
CVE-2026-53753 CRITICAL
9.8 Jun 16

Unauthenticated remote code execution in Crawl4AI versions <= 0.8.6 allows attackers to escape the AST-based sandbox in

CVE-2026-48519 CRITICAL
9.6 Jun 16

Remote code execution in Langflow versions through 1.9.1 allows unauthenticated attackers to execute arbitrary Python co
CVE-2026-45833 CRITICAL
9.4 Jun 12

Authenticated remote code execution in ChromaDB Python project versions 0.4.17 and later enables attackers holding the U
CVE-2026-47103 CRITICAL
9.3 Jun 17

Remote code execution in python-statemachine 3.0.0 through 3.1.x allows attackers to run arbitrary Python in the host pr

Vendor StatusVendor

Ubuntu

Priority: Medium
python-urllib3
Release Status Version
upstream needs-triage -
bionic not-affected code not present
focal released 1.25.8-2ubuntu0.4+esm2
jammy released 1.26.5-1~exp1ubuntu0.4
trusty not-affected code not present
xenial not-affected code not present
noble released 2.0.7-1ubuntu0.3
plucky released 2.3.0-2ubuntu0.2
questing released 2.3.0-3ubuntu0.1
python-pip
Release Status Version
upstream needs-triage -
bionic not-affected code not present
jammy needed -
noble needed -
questing needed -
trusty not-affected code not present
xenial not-affected code not present
plucky ignored end of life, was needed
focal released 20.0.2-5ubuntu1.11+esm4
USN-7927-1 USN-8010-1

Debian

Bug #1122030
python-urllib3
Release Status Fixed Version Urgency
bullseye fixed 1.26.5-1~exp1+deb11u2 -
bullseye (security) fixed 1.26.5-1~exp1+deb11u3 -
bookworm fixed 1.26.12-1+deb12u2 -
bookworm (security) fixed 1.26.12-1+deb12u3 -
trixie (security), trixie fixed 2.3.0-3+deb13u1 -
forky, sid fixed 2.6.3-1 -
trixie fixed 2.3.0-3+deb13u1 -
(unstable) fixed 2.5.0-1.1 -
DLA-4421-1 DSA-6102-1

SUSE

Severity: High
Product Status
Container suse/manager/4.3/proxy-tftpd:4.3.16.2.9.63.10 Container suse/manager/5.0/x86_64/proxy-tftpd:latest Container suse/manager/5.0/x86_64/server:latest Container suse/multi-linux-manager/5.1/x86_64/proxy-tftpd:5.1.2.8.13.1 Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-GCE-3P Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-GCE-3P Image proxy-tftpd-image Affected
Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.2.9.13.2 Image SLES15-SP6 Image SLES15-SP6-Azure-3P Image SLES15-SP6-Azure-Basic Image SLES15-SP6-Azure-Standard Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-HPC Image SLES15-SP6-HPC-Azure Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-Azure-3P Image SLES15-SP6-SAP-BYOS-Azure Image SLES15-SP6-SAP-Hardened-Azure Image SLES15-SP6-SAP-Hardened-BYOS-Azure Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-HPC-Azure Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image proxy-salt-broker-image Affected
Container suse/multi-linux-manager/5.1/x86_64/server:5.1.2.8.13.2 Image SLES15-SP4-BYOS Image SLES15-SP4-BYOS-EC2 Image SLES15-SP4-HPC-BYOS Image SLES15-SP4-HPC-BYOS-EC2 Image SLES15-SP4-HPC-EC2 Image SLES15-SP4-Hardened-BYOS Image SLES15-SP4-Hardened-BYOS-EC2 Image SLES15-SP4-SAP-BYOS Image SLES15-SP4-SAP-BYOS-EC2 Image SLES15-SP4-SAP-Hardened-BYOS Image SLES15-SP4-SAP-Hardened-BYOS-EC2 Image SLES15-SP5-BYOS-EC2 Image SLES15-SP5-HPC-BYOS-EC2 Image SLES15-SP5-Hardened-BYOS-EC2 Image SLES15-SP5-SAP-BYOS-EC2 Image SLES15-SP5-SAP-Hardened-BYOS-EC2 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-SAP-BYOS Image SLES15-SP6-SAP-BYOS-EC2 Image SLES15-SP6-SAP-Hardened-BYOS Image SLES15-SP6-SAP-Hardened-BYOS-EC2 Image SLES15-SP6-SAP-Hardened-EC2 Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image server-image Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.24 Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.4 Affected

Share

EUVD-2025-201421 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy