CVE-2026-97688: urllib3 Infinite Loop in Chunked Deflate Streaming
Summary
CVE-2026-97688: urllib3: Chunked Deflate streaming can enter an infinite loop. Affects urllib3 versions >= 2.6.2, < 2.8.0. Fixed in 2.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a powerful, user-friendly HTTP client for Python that allows developers to send HTTP requests and handle responses efficiently. It is designed to manage large HTTP responses by streaming content in chunks, which conserves memory and improves performance. However, certain versions of urllib3 are vulnerable to a specific issue when handling compressed, chunked responses, particularly when the response comes from untrusted sources.
Vulnerability Detail
The vulnerability arises in urllib3 versions 2.6.2 through 2.7.0, where the streaming API can enter an infinite loop when processing a chunked response that contains bytes after the end of the Deflate stream. This occurs because the zlib implementation in Python retains trailing bytes as unconsumed input, leading urllib3 to repeatedly attempt to decode the same bytes without making progress. A malicious server could exploit this flaw, causing excessive CPU usage and preventing the affected request from completing, as network read timeouts would not interrupt the loop due to the lack of further socket operations.
How To Fix
Latest published version: 2.8.0 as of 23 Oct 2026
pip install --upgrade "urllib3==2.8.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, you can disable automatic content decoding for responses from untrusted sources by setting decode_content=False in your HTTP request. Alternatively, you can reject streamed responses that use Deflate content encoding.
Conclusion
The vulnerability identified as CVE-2026-97688 in urllib3 poses a significant risk when handling compressed, chunked HTTP responses from untrusted sources. It is crucial to upgrade to the patched version 2.8.0 or implement workarounds to mitigate potential exploitation.
See every vulnerability recorded for urllib3 →
FAQ
urllib3 versions 2.6.2 through 2.7.0 are affected by this vulnerability.
The vulnerability can lead to excessive CPU usage and prevent HTTP requests from completing, potentially causing denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot upgrade, disable automatic content decoding for untrusted sources or avoid using Deflate content encoding for streamed responses.
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for urllib3.
