Critical Security Flaw in python3.11-urllib3: Unbounded Decompression and Streaming API Vulnerabilities
Summary
RLSA-2026:1224: Important: python3.11-urllib3 security update. Affects python3.11-urllib3 versions < 0:1.26.12-6.el8_10. Fixed in 0:1.26.12-6.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3.11-urllib3 is a widely used library in Python for handling HTTP requests. It provides a powerful interface for managing connections, handling data streams, and ensuring secure communication over the web. However, vulnerabilities in this library can lead to severe security risks, particularly in how it processes compressed data and handles HTTP redirects.
Vulnerability Detail
The vulnerabilities identified in python3.11-urllib3 include an unbounded decompression chain that can lead to resource exhaustion (CVE-2025-66418), improper handling of highly compressed data in the Streaming API (CVE-2025-66471), and a bypass of decompression-bomb safeguards when following HTTP redirects (CVE-2026-21441). These issues can result in denial of service attacks, where an attacker could exploit these flaws to exhaust system resources, potentially leading to application crashes or unavailability.
How To Fix
Minimum fixed version
0:1.26.12-6.el8_10
This is the first release that contains the fix.
sudo dnf update python3.11-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the size of incoming compressed data or implementing additional checks before processing data streams. This can help mitigate the risk of resource exhaustion until the package is updated.
Conclusion
The vulnerabilities in python3.11-urllib3 pose significant security risks that can lead to resource exhaustion and denial of service. It is crucial to update to the latest patched version to safeguard your applications. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for python3.11-urllib3 →
FAQ
The CVSS score of the vulnerability is 7.5, indicating a high severity level.
These vulnerabilities can lead to denial of service attacks, causing applications to crash or become unavailable due to resource exhaustion.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities in real-time.
Yes, you can implement checks on the size of incoming compressed data and limit the processing of data streams as a temporary measure.
For more details, refer to the CVE pages associated with the vulnerabilities: CVE-2025-66418, CVE-2025-66471, and CVE-2026-21441.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.11-urllib3.
