Critical Security Flaw in python3.12-urllib3: Unbounded Decompression Chain and Streaming API Vulnerabilities
Summary
RLSA-2026:1226: Important: python3.12-urllib3 security update. Affects python3.12-urllib3 versions < 0:1.26.19-2.el8_10. Fixed in 0:1.26.19-2.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3.12-urllib3 is a widely used library in Python for handling HTTP requests. It provides a powerful and user-friendly interface for making web requests, managing connections, and handling responses. The library is essential for developers who need to interact with web services and APIs. However, recent vulnerabilities have been identified that could lead to significant resource exhaustion and security risks when handling compressed data.
Vulnerability Detail
The vulnerabilities in python3.12-urllib3 stem from improper handling of compressed data in its Streaming API. Specifically, an unbounded decompression chain can lead to resource exhaustion, allowing attackers to exploit this flaw to crash services or consume excessive resources. Additionally, a safeguard bypass when following HTTP redirects can expose systems to decompression bombs, further exacerbating the risk. These vulnerabilities can severely impact the performance and security of applications relying on this library.
How To Fix
Minimum fixed version
0:1.26.19-2.el8_10
This is the first release that contains the fix.
sudo dnf update python3.12-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the size of compressed data that your application processes. This can help mitigate the risk of resource exhaustion until the package is updated. Additionally, avoid following HTTP redirects for untrusted sources to reduce exposure to decompression bomb attacks.
Conclusion
The vulnerabilities in python3.12-urllib3 pose significant risks to applications that rely on this library for HTTP requests. It is crucial to update to the patched version to mitigate these risks. Additionally, using tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for python3.12-urllib3 →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Decompression bombs are files that are highly compressed and expand to a massive size when decompressed, potentially overwhelming system resources.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If you cannot update the package immediately, implement workarounds such as limiting the size of compressed data processed and avoiding untrusted HTTP redirects.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-urllib3.
