Critical Security Update for python3.11-urllib3: Addressing Resource Exhaustion and Decompression Bomb Vulnerabilities
Summary
ALSA-2026:1089: Important: python3.11-urllib3 security update. Affects python3.11-urllib3 versions < 1.26.12-5.el9_7.1. Fixed in 1.26.12-5.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted programming language known for its object-oriented features, dynamic typing, and extensive libraries. The urllib3 module, part of Python's ecosystem, is a powerful HTTP client that simplifies the process of making web requests. However, vulnerabilities in urllib3 can lead to severe security issues, including resource exhaustion and improper handling of compressed data, which can be exploited by attackers.
Vulnerability Detail
The vulnerabilities in urllib3 stem from an unbounded decompression chain that can lead to resource exhaustion (CVE-2025-66418), improper handling of highly compressed data in the Streaming API (CVE-2025-66471), and a bypass of decompression-bomb safeguards when following HTTP redirects (CVE-2026-21441). These issues can allow attackers to create malicious payloads that consume excessive resources or exploit the system's handling of compressed data, potentially leading to denial of service or other security breaches.
How To Fix
Minimum fixed version
1.26.12-5.el9_7.1
This is the first release that contains the fix.
sudo dnf update python3.11-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the size of incoming compressed data or implementing additional checks in your application to handle unexpected data sizes. However, updating to the patched version is the recommended solution.
Conclusion
The vulnerabilities in python3.11-urllib3 pose significant risks that can lead to resource exhaustion and security breaches. It is crucial to update to the patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python3.11-urllib3 →
FAQ
Urllib3 is a powerful HTTP client for Python that simplifies making web requests and handling responses.
The vulnerabilities can lead to resource exhaustion, denial of service, and potential exploitation of the system through malicious payloads.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
If an immediate update is not possible, implement temporary workarounds such as limiting the size of incoming compressed data.
For detailed information, refer to the CVE pages linked in the vulnerability details, which provide insights into the impact and technical specifics.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11-urllib3.
