Infinite Loop Vulnerability in python-urllib3: Excessive CPU Usage Risk
Summary
DEBIAN-CVE-2026-97688: urllib3 is an HTTP client library for Python. Affects python-urllib3 versions < 2.8.0-1. Fixed in 2.8.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a widely used HTTP client library for Python, known for its simplicity and ease of use in making HTTP requests. It provides features such as connection pooling, client-side SSL/TLS verification, and support for various HTTP methods. However, versions 2.6.2 to 2.8.0 are vulnerable to a specific issue that can lead to excessive CPU usage and unresponsive requests when interacting with untrusted servers.
Vulnerability Detail
The vulnerability arises from the HTTPResponse.stream and HTTPResponse.read_chunked methods, which can enter an infinite loop due to the Deflate decoder retaining trailing bytes as unconsumed input. This occurs when a malicious server sends a chunked Deflate response with trailing bytes after the Deflate stream, leading to excessive CPU usage and requests that do not complete. The issue is particularly problematic when the response has Transfer-Encoding: chunked and Content-Encoding: deflate, with content decoding enabled and a positive finite chunk size.
How To Fix
Minimum fixed version
2.8.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling content decoding for responses from untrusted servers or implementing additional validation checks on the response content to prevent processing of potentially malicious data.
Conclusion
The vulnerability in python-urllib3 poses a significant risk due to the potential for infinite loops and excessive CPU usage when interacting with malicious servers. It is crucial to update to the patched version 2.8.0 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python-urllib3 →
FAQ
Versions from 2.6.2 to 2.8.0 are affected by this vulnerability.
The main consequence is excessive CPU usage and requests that do not complete, potentially leading to denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, the vulnerability is fixed in version 2.8.0 of python-urllib3.
If immediate updates are not possible, consider implementing workarounds such as disabling content decoding for untrusted responses.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-urllib3.
