PT-2026-51014 · Urllib3 · Urllib3/Urllib3

Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-9375

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (preload content=False) when using Brotli support. The issue arises due to three independent code paths in response.py that bypass the max length protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative max length values can be produced due to buffer arithmetic in read(), flush decoder unconditionally overrides max length to -1, and flush decoder() passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using requests or urllib3 to stream content from untrusted sources.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-9375

Affected Products

Urllib3/Urllib3

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-9375 · Security Note
• https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a · Note
• https://huntr.com/bounties/ddd09eb9-b87d-4a43-84df-48837b1bbc23 · Note