Critical Security Flaw in python3.12-urllib3: Unbounded Decompression Chain and Streaming API Issues
Summary
RLSA-2026:1088: Important: python3.12-urllib3 security update. Affects python3.12-urllib3 versions < 0:1.26.19-1.el9_7.1. Fixed in 0:1.26.19-1.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3.12-urllib3 is a widely used library in Python for making HTTP requests. It provides a powerful and user-friendly interface for handling various aspects of HTTP, including connection pooling, client-side SSL verification, and more. However, it has recently been identified as vulnerable to several security issues that could lead to resource exhaustion and potential denial of service.
Vulnerability Detail
The vulnerabilities in python3.12-urllib3 stem from improper handling of compressed data and an unbounded decompression chain. Specifically, CVE-2025-66418 allows attackers to exploit the library by sending highly compressed data, leading to resource exhaustion. CVE-2025-66471 highlights issues with the Streaming API that does not adequately manage this data, while CVE-2026-21441 reveals a bypass of decompression-bomb safeguards when following HTTP redirects. These vulnerabilities could result in significant performance degradation or service outages.
How To Fix
Minimum fixed version
0:1.26.19-1.el9_7.1
This is the first release that contains the fix.
sudo dnf update python3.12-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the size of incoming compressed data or implement additional checks before processing it. This can help mitigate the risk of resource exhaustion while you work on updating the package.
Conclusion
In summary, the python3.12-urllib3 library has critical vulnerabilities that need immediate attention. Updating to the latest patched version is crucial to maintaining the security and stability of applications that rely on this library. Utilizing tools like Vulert can further enhance your ability to monitor and manage vulnerabilities effectively.
See every vulnerability recorded for python3.12-urllib3 →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high level of severity.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability could lead to resource exhaustion, denial of service, and potential exploitation by malicious actors.
Yes, you should upgrade to version 0:1.26.19-1.el9_7.1 or later to ensure that the vulnerabilities are patched.
Vulert is a service that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. It provides real-time alerts for vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-urllib3.
