Critical Security Update for python3.12-urllib3: Addressing Resource Exhaustion and Decompression Bomb Vulnerabilities
Summary
ALSA-2026:1226: Important: python3.12-urllib3 security update. Affects python3.12-urllib3 versions < 1.26.19-2.el8_10. Fixed in 1.26.19-2.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. The urllib3 module is a powerful HTTP library for Python that enables users to send HTTP requests and handle responses efficiently. However, recent vulnerabilities have been identified in urllib3 that could lead to severe security issues, including resource exhaustion and decompression bomb attacks, particularly when handling compressed data.
Vulnerability Detail
The vulnerabilities in urllib3 stem from improper handling of compressed data and HTTP redirects. Specifically, CVE-2025-66418 describes an unbounded decompression chain that can lead to resource exhaustion, potentially crashing the application. CVE-2025-66471 highlights issues with the Streaming API that fails to manage highly compressed data correctly, while CVE-2026-21441 points to a safeguard bypass when following HTTP redirects, allowing decompression bombs to exploit the system's resources.
How To Fix
Minimum fixed version
1.26.19-2.el8_10
This is the first release that contains the fix.
sudo dnf update python3.12-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the size of the data being processed by urllib3 to mitigate the risk of resource exhaustion. This can be done by implementing checks in your code to restrict the size of incoming compressed data. For example, you can add a condition to reject requests that exceed a certain size threshold.
Conclusion
In summary, the vulnerabilities in python3.12-urllib3 pose significant risks, including resource exhaustion and decompression bomb attacks. It is crucial to update to the latest patched version to safeguard your applications. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for python3.12-urllib3 →
FAQ
Urllib3 is a powerful HTTP library for Python that simplifies sending HTTP requests and handling responses.
The main vulnerabilities include resource exhaustion due to unbounded decompression chains and improper handling of compressed data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If an immediate update is not possible, implement size checks on incoming compressed data to reduce the risk of exploitation.
For more details, refer to the CVE pages associated with the vulnerabilities: CVE-2025-66418, CVE-2025-66471, and CVE-2026-21441.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-urllib3.
