urllib3 EUVD-2026-89007

Exploitation requires ALL of the following on the victim client: (1) the application uses vulnerable urllib3 2.6.2 through 2.7.x; (2) it consumes the response via HTTPResponse.stream() or read_chunked() with content decoding enabled (decode_content=True) and a positive finite streaming chunk size (amt=N), not preloaded content; (3) the client connects to a server the attacker controls or has compromised, since this is a client-side flaw triggered by the SERVER's response - not a listener an attacker can reach directly. The malicious response must carry Transfer-Encoding: chunked AND Content-Encoding: deflate, a decoded body larger than the chunk size, and trailing bytes appended after the deflate stream. LIMITING FACTORS: the attacker must be able to steer the client to a hostile endpoint (malicious URL, SSRF target, MITM, or compromised upstream); default preload_content=True usage or brotli/zstd encodings are not affected in the same way; no impact to confidentiality or integrity.

This is a genuine but moderate-severity availability-only issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L) correctly captures a network-reachable, unauthenticated, no-interaction denial-of-service with no confidentiality or integrity impact, scoring 6.9. The critical nuance is the direction of the attack: this is a CLIENT-side vulnerability where a MALICIOUS or COMPROMISED SERVER victimizes a urllib3-using client - not a server-side flaw an attacker sprays against exposed services. That inversion, combined with the specific trigger conditions (chunked + deflate + trailing bytes + finite streaming amt), meaningfully limits real-world exploitability despite PR:N/UI:N. No EPSS score, KEV listing, or public POC was provided in the intelligence, and the reporter is a GitHub advisory (GHSA-gh4c-6fx4-qh6g) rather than an in-the-wild disclosure - consistent with a responsibly-disclosed library bug, not an actively exploited threat. Signals are mutually consistent: high theoretical reachability (VA:L, AC:L) but no evidence of exploitation and a narrow trigger surface. The VA:L (low availability) rating is arguably conservative given the loop is infinite and read timeouts do not interrupt it, so a single request can pin a worker thread indefinitely (I would lean A:H at CVSS 3.1). Net: real and worth patching, especially for services that fetch from untrusted URLs, but not an emergency for typical clients calling trusted endpoints.

An attacker who controls a server (or can MITM/redirect an application into fetching an attacker-controlled URL) returns an HTTP response with Transfer-Encoding: chunked and Content-Encoding: deflate, where the deflate stream is followed by extra trailing bytes and the decoded body exceeds the client's finite streaming chunk size. When the vulnerable urllib3 client (2.6.2-2.7.x) calls HTTPResponse.stream() or read_chunked() with content decoding enabled, the Deflate decoder repeatedly re-processes the unconsumed trailing bytes after EOF without progress, spinning CPU forever with the request never completing and read timeouts unable to break the loop. No public POC was provided, though the fix commit includes a regression test that constructs the malicious payload.