Critical Security Update for python3-urllib3: Addressing Resource Exhaustion and Decompression Bomb Vulnerabilities
Summary
ALSA-2026:1086: Important: python-urllib3 security update. Affects python3-urllib3 versions < 1.26.19-2.el10_1.1. Fixed in 1.26.19-2.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3-urllib3 is a powerful HTTP library for Python that enables users to send HTTP requests easily and efficiently. It is widely used in various applications due to its simplicity and flexibility. However, recent vulnerabilities have been identified that could lead to severe resource exhaustion and security breaches, particularly when handling compressed data.
Vulnerability Detail
The vulnerabilities in python3-urllib3 stem from improper handling of compressed data, which can lead to resource exhaustion through an unbounded decompression chain (CVE-2025-66418) and issues with the Streaming API when processing highly compressed data (CVE-2025-66471). Additionally, a safeguard bypass vulnerability (CVE-2026-21441) allows attackers to exploit decompression bombs when following HTTP redirects, potentially leading to denial of service and system crashes.
How To Fix
Minimum fixed version
1.26.19-2.el10_1.1
This is the first release that contains the fix.
sudo dnf update python3-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider limiting the size of incoming requests or implementing rate limiting to mitigate the impact of potential resource exhaustion. Additionally, avoid processing untrusted compressed data until the package is updated.
Conclusion
The vulnerabilities in python3-urllib3 pose significant risks to applications that rely on this library for HTTP requests. It is crucial to update to the latest patched version to ensure the security and stability of your applications. Implementing workarounds can provide temporary relief, but a permanent fix through updating is recommended.
See every vulnerability recorded for python3-urllib3 →
FAQ
The vulnerabilities can lead to resource exhaustion, denial of service, and potential system crashes, especially when handling compressed data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json at Vulert Scanner to check for vulnerabilities.
Yes, you can implement rate limiting and restrict the size of incoming requests to reduce the risk of exploitation until you can apply the patch.
Versions prior to 1.26.19-2.el10_1.1 are affected by these vulnerabilities.
For more details, refer to the CVE pages listed in the related section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for python3-urllib3.
