CVE-2025-66418: urllib3 Unbounded Decompression Chain Vulnerability
Summary
CVE-2025-66418: urllib3 allows an unbounded number of links in the decompression chain. Affects urllib3 versions >= 1.24, < 2.6.0. Fixed in 2.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a powerful, user-friendly HTTP client for Python that provides features such as connection pooling, client-side SSL/TLS verification, and support for various HTTP methods. It is widely used in applications and libraries to handle HTTP requests. However, a recent vulnerability has been identified that allows an unbounded number of links in the decompression chain, posing significant risks when interacting with untrusted sources.
Vulnerability Detail
The vulnerability arises from urllib3's support for chained HTTP encoding algorithms as specified in RFC 9110, which allows for multiple layers of content encoding (e.g., gzip, zstd). The issue is that there is no limit to the number of compression steps that can be applied, enabling a malicious server to craft responses that lead to excessive CPU usage and memory allocation. This can result in denial of service or application crashes due to resource exhaustion.
How To Fix
Latest published version: 2.8.0 as of 23 Oct 2026
pip install --upgrade "urllib3==2.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.6.0
This is the first release that contains the fix.
pip install --upgrade "urllib3==2.6.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, you can mitigate the risk by setting 'preload_content=False' when making requests. Additionally, ensure that the response headers contain a safe number of encodings before processing the response content. Example code:
import urllib3 http = urllib3.PoolManager() response = http.request('GET', 'http://example.com', preload_content=False) if len(response.headers.get('content-encoding', '').split(',')) <= 5: content = response.data else: print('Unsafe number of encodings detected.')
Conclusion
The CVE-2025-66418 vulnerability in urllib3 poses significant risks due to its unbounded decompression chain. It is crucial for users of affected versions to upgrade to at least version 2.6.0 to mitigate these risks. If immediate upgrading is not possible, implementing the suggested workarounds can help reduce exposure to this vulnerability.
See every vulnerability recorded for urllib3 →
FAQ
CVE-2025-66418 is a vulnerability in urllib3 that allows an unbounded number of links in the decompression chain, potentially leading to high CPU usage and memory allocation.
All versions of urllib3 up to and including 2.5.0 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate upgrade is not possible, set 'preload_content=False' in your requests and validate the number of encodings in the response headers.
The vulnerability can lead to denial of service, application crashes, and excessive resource consumption if exploited by a malicious server.
References
Related vulnerabilities
Recent vulnerabilities recorded for urllib3.
