CVE-2026-97689: urllib3 Unbounded Chunk-Size Buffering Vulnerability
Summary
CVE-2026-97689: urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory. Affects urllib3 versions >= 1.10.3, < 2.8.0. Fixed in 2.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a powerful, user-friendly HTTP client for Python that provides features such as connection pooling, client-side SSL/TLS verification, and support for HTTP/1.1 and HTTP/2. It is widely used in various applications and libraries for making HTTP requests. However, a vulnerability has been identified in its streaming API, which can lead to excessive memory consumption when handling chunked HTTP responses from untrusted sources.
Vulnerability Detail
The vulnerability arises from the way urllib3 handles chunked-transfer-encoded responses. When a malicious HTTP server sends a chunk-size field without a newline, urllib3's streaming client can buffer an unbounded amount of data into memory before it can reject the invalid chunk size. This can lead to denial of service or memory exhaustion, as the application may allocate more memory than intended. The issue affects urllib3 versions prior to 2.8.0, specifically the read_chunked() and stream() methods of the HTTPResponse object.
How To Fix
Minimum fixed version
2.8.0
This is the first release that contains the fix.
pip install --upgrade "urllib3==2.8.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider using the read() method to read the entire response at once instead of streaming it. This can be done with the following code: response = http_response.read(). This approach avoids the chunked response handling and mitigates the risk associated with the vulnerability.
Conclusion
In summary, the CVE-2026-97689 vulnerability in urllib3 poses a significant risk due to unbounded chunk-size buffering, which can lead to memory exhaustion. Users are advised to upgrade to version 2.8.0 or later to mitigate this risk. For those unable to upgrade immediately, using the read() method is a viable workaround.
See every vulnerability recorded for urllib3 →
FAQ
The CVSS score of this vulnerability is 8.9, indicating a high severity level.
All versions of urllib3 prior to 2.8.0 are affected by this vulnerability.
The vulnerability can lead to denial of service or memory exhaustion due to unbounded memory allocation when processing chunked responses from untrusted sources.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software, using just the Pipfile.lock.
References
Related vulnerabilities
Recent vulnerabilities recorded for urllib3.
