Critical Security Update for python3.12-urllib3: Unbounded Decompression Vulnerabilities
Summary
ALSA-2026:1088: Important: python3.12-urllib3 security update. Affects python3.12-urllib3 versions < 1.26.19-1.el9_7.1. Fixed in 1.26.19-1.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a versatile, interpreted programming language known for its object-oriented features, dynamic typing, and extensive libraries. The urllib3 module is a powerful HTTP client for Python, enabling users to send HTTP requests and handle responses efficiently. However, vulnerabilities in urllib3 can lead to severe security risks, particularly in handling compressed data, which can be exploited by attackers to exhaust system resources.
Vulnerability Detail
The vulnerabilities in urllib3 stem from improper handling of compressed data, leading to resource exhaustion and potential denial of service. Specifically, the issues include an unbounded decompression chain (CVE-2025-66418), improper handling of highly compressed data in the Streaming API (CVE-2025-66471), and a safeguard bypass when following HTTP redirects (CVE-2026-21441). These vulnerabilities can allow attackers to exploit the system by sending specially crafted requests, resulting in significant performance degradation or complete service unavailability.
How To Fix
Minimum fixed version
1.26.19-1.el9_7.1
This is the first release that contains the fix.
sudo dnf update python3.12-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider implementing rate limiting on incoming requests to mitigate the risk of resource exhaustion. Additionally, avoid processing highly compressed data until the package is updated.
Conclusion
The vulnerabilities in python3.12-urllib3 pose significant security risks that can lead to resource exhaustion and denial of service. It is crucial to update to the patched version to mitigate these risks effectively. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for python3.12-urllib3 →
FAQ
Urllib3 is a powerful HTTP client for Python that simplifies sending HTTP requests and handling responses.
The vulnerabilities can lead to resource exhaustion, denial of service, and potential exploitation by attackers through specially crafted requests.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement rate limiting on incoming requests and avoid processing highly compressed data until the package is updated.
For more details, refer to the CVE pages associated with the vulnerabilities: CVE-2025-66418, CVE-2025-66471, and CVE-2026-21441.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-urllib3.
