CVE-2026-9375
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile — higher than 22% of all known CVEs
Summary
Version 2.6.3 of the urllib3 library is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises from three independent code paths that bypass the `max_length` protection, allowing a malicious HTTP server to trigger an out-of-memory (OOM) condition.
Risk Assessment
This vulnerability could lead to denial of service (DoS) in applications and libraries using `requests` or `urllib3`, which may severely impact service availability in the organization.
Recommendation
It is recommended to update to the latest version of urllib3 to mitigate this vulnerability and to monitor applications using this library for potential attack attempts.
Original NVD description (English source)
urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.