PT-2026-51014 · Urllib3 · Urllib3/Urllib3

Publicado 2026-06-19 · Atualizado 2026-06-19 · CVE-2026-9375

NVD

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (preload content=False) when using Brotli support. The issue arises due to three independent code paths in response.py that bypass the max length protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative max length values can be produced due to buffer arithmetic in read(), flush decoder unconditionally overrides max length to -1, and flush decoder() passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using requests or urllib3 to stream content from untrusted sources.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2026-9375

Produtos afetados

Urllib3/Urllib3

Referências · 3

• https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a · Nota
• https://huntr.com/bounties/ddd09eb9-b87d-4a43-84df-48837b1bbc23 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-9375 · Nota de Segurança