Critical Security Update for python3.11-urllib3: Unbounded Decompression Chain Vulnerability
Summary
ALSA-2026:1224: Important: python3.11-urllib3 security update. Affects python3.11-urllib3 versions < 1.26.12-6.el8_10. Fixed in 1.26.12-6.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted programming language known for its object-oriented features and dynamic typing. The urllib3 library, part of the Python ecosystem, is essential for handling HTTP requests and responses. It provides a robust interface for managing connections and data streams. However, vulnerabilities in urllib3 can lead to severe security risks, particularly concerning resource exhaustion and improper handling of compressed data.
Vulnerability Detail
The vulnerability in question arises from an unbounded decompression chain in urllib3, which can lead to resource exhaustion. This issue allows an attacker to craft a malicious payload that, when processed, consumes excessive system resources, potentially leading to denial of service. Additionally, the streaming API of urllib3 improperly handles highly compressed data, and there is a risk of decompression-bomb safeguard bypass when following HTTP redirects. These vulnerabilities are identified as CVE-2025-66418, CVE-2025-66471, and CVE-2026-21441.
How To Fix
Minimum fixed version
1.26.12-6.el8_10
This is the first release that contains the fix.
sudo dnf update python3.11-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the size of incoming data or implement rate limiting on your application to reduce the risk of resource exhaustion. However, the best practice is to update to the patched version as soon as possible.
Conclusion
The vulnerabilities in python3.11-urllib3 pose significant risks, including resource exhaustion and denial of service. It is essential to update to the patched version to safeguard your applications. Utilize tools like Vulert to monitor and check for vulnerabilities in your software effectively.
See every vulnerability recorded for python3.11-urllib3 →
FAQ
The vulnerability can lead to resource exhaustion, potentially causing denial of service for applications relying on urllib3.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions prior to 1.26.12-6.el8_10 are affected by this vulnerability.
Yes, a patched version 1.26.12-6.el8_10 is available to fix the vulnerabilities.
Implement temporary workarounds such as limiting incoming data size or applying rate limiting until you can update.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11-urllib3.
