Critical Security Update for python3-urllib3: Addressing Resource Exhaustion and Decompression Bomb Vulnerabilities
Summary
ALSA-2026:1254: Important: python-urllib3 security update. Affects python3-urllib3 versions < 1.24.2-9.el8_10. Fixed in 1.24.2-9.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3-urllib3 is a widely used HTTP library for Python that provides powerful features for making HTTP requests. It supports connection pooling, client-side SSL/TLS verification, and various other functionalities that enhance the performance and security of web applications. However, recent vulnerabilities have been identified that could compromise the integrity and availability of applications relying on this library.
Vulnerability Detail
The vulnerabilities in python3-urllib3 stem from issues related to unbounded decompression chains and improper handling of highly compressed data. Specifically, CVE-2025-66418 allows for resource exhaustion due to excessive memory consumption during decompression. CVE-2025-66471 highlights a flaw in the Streaming API that fails to manage highly compressed data correctly, potentially leading to denial of service. Additionally, CVE-2026-21441 exposes a safeguard bypass when following HTTP redirects, which could allow attackers to exploit decompression bombs more easily. These vulnerabilities can lead to significant performance degradation and application crashes.
How To Fix
Minimum fixed version
1.24.2-9.el8_10
This is the first release that contains the fix.
sudo dnf update python3-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing rate limiting on HTTP requests to mitigate the impact of potential resource exhaustion. Additionally, avoid processing untrusted or highly compressed data until the library is updated.
Conclusion
The vulnerabilities identified in python3-urllib3 pose significant risks to applications relying on this library. It is crucial to update to the patched version to ensure the security and stability of your applications. Implementing workarounds can provide temporary relief, but a permanent fix through an update is recommended.
See every vulnerability recorded for python3-urllib3 →
FAQ
Python3-urllib3 is an HTTP library for Python that simplifies making HTTP requests and managing connections.
The main vulnerabilities include resource exhaustion due to unbounded decompression chains and improper handling of compressed data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement rate limiting on HTTP requests and avoid processing untrusted compressed data until the update can be applied.
For more details, refer to the CVE pages associated with the vulnerabilities: CVE-2025-66418, CVE-2025-66471, and CVE-2026-21441.
Related vulnerabilities
Recent vulnerabilities recorded for python3-urllib3.
