Skip to main content

urllib3 EUVDEUVD-2026-38064

| CVE-2026-9375 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-06-19 @huntr_ai GHSA-mwq6-fg78-p6cq
Denial Of Service Urllib3 Suse Urllib3 Urllib3
7.5
CVSS 3.0 · Vendor: huntr_ai
Share

Severity by source

Vendor (huntr_ai) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Victim client only needs to fetch attacker-controlled URL with streaming + Brotli enabled (AV:N, AC:L, PR:N, UI:N); impact is memory exhaustion DoS, no C/I loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

Primary rating from Vendor (huntr_ai).

CVSS VectorVendor: huntr_ai

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Patch available
Jun 19, 2026 - 21:02 EUVD
Source Code Evidence Fetched
Jun 19, 2026 - 19:30 vuln.today
Analysis Generated
Jun 19, 2026 - 19:30 vuln.today

DescriptionCVE.org

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (preload_content=False) when using Brotli support. The issue arises due to three independent code paths in response.py that bypass the max_length protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative max_length values can be produced due to buffer arithmetic in read(), flush_decoder unconditionally overrides max_length to -1, and _flush_decoder() passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using requests or urllib3 to stream content from untrusted sources.

AnalysisAI

Denial-of-service in urllib3 2.6.3 allows a malicious HTTP server to exhaust client memory via a Brotli decompression bomb that bypasses the streaming API's max_length safeguard added in 2.6.0 (CVE-2025-66471). Any Python application using urllib3 or requests with preload_content=False to stream Brotli-encoded responses from untrusted origins is exposed. No public exploit identified at time of analysis, though an upstream commit and GHSA-mf9v-mfxr-j63j confirm the regression.

Technical ContextAI

urllib3 is the underlying HTTP client library used by requests and large portions of the Python ecosystem. The flaw sits in src/urllib3/response.py and is a CWE-400 Uncontrolled Resource Consumption issue: three independent paths circumvent the per-read decompression cap. In read(), an arithmetic miscalculation can pass a negative amt into the Brotli decoder, which treats it as unlimited; drain_conn() invoked read() with the decoder still attached, forcing full decompression of pending bytes; and _flush_decoder() invoked the decoder with no limit argument at all. Combined with the official google/brotli library's streaming behavior (issue 1396), an attacker-controlled Content-Encoding: br stream can be expanded fully into memory on the second read or during connection drain, defeating the chunked-streaming model the API promises.

RemediationAI

Upstream fix available (commit 2bdcc44d1e163fb5cc48a8662425e35e15adfe6a); released patched version not independently confirmed from the provided data, so upgrade to the next urllib3 release above 2.6.3 carrying GHSA-mf9v-mfxr-j63j once published, and rebuild any pinned requests/urllib3 dependencies accordingly. As compensating controls until a tagged release is available, uninstall the optional Brotli package (pip uninstall brotli) to disable the vulnerable decode path at the cost of losing br content-encoding support, or switch streaming consumers to preload_content=True with an explicit Content-Length cap, accepting higher peak memory on legitimate large responses. For server-side fetchers, restrict outbound HTTP to allowlisted hosts and impose process-level memory limits (cgroups/ulimit -v) so a bomb response kills the worker rather than the host. Track the advisory at https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j for the canonical fixed version.

More in Urllib3

View all
CVE-2024-37891 MEDIUM POC
6.5 Jun 17

urllib3 is a user-friendly HTTP client library for Python. Rated medium severity (CVSS 6.5), this vulnerability is remot
CVE-2019-11236 MEDIUM POC
6.1 Apr 15

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parame
CVE-2018-20060 CRITICAL
9.8 Dec 11

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e.,

CVE-2025-50181 MEDIUM POC
5.3 Jun 19

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all r
CVE-2026-21441 HIGH
8.9 Jan 07

Uncontrolled resource consumption in the Python urllib3 HTTP client library (versions 1.22 through 2.6.2) lets a malicio
CVE-2023-43804 HIGH
8.1 Oct 04

urllib3 is a user-friendly HTTP client library for Python. Rated high severity (CVSS 8.1), this vulnerability is remotel
CVE-2025-66418 HIGH
7.5 Dec 05

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of li
CVE-2025-66471 HIGH
7.5 Dec 05

A security vulnerability in version 1.0 and (CVSS 7.5). High severity vulnerability requiring prompt remediation. Vendor
CVE-2021-33503 HIGH
7.5 Jun 29

An issue was discovered in urllib3 before 1.26.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
CVE-2020-7212 HIGH
7.5 Mar 06

The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denia
CVE-2019-11324 HIGH
7.5 Apr 18

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is differ
CVE-2021-28363 MEDIUM
6.5 Mar 15

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HT

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-38064 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy