urllib3 vulnerabilities

The urllib3 HTTP client library for Python versions 2.6.0 to before 2.7.0 contains a vulnerability where the entire response is decompressed instead of the requested portion during the second HTTPResponse.read(amt=N) call when using the official Brotli library, or after HTTPResponse.drain_conn() is called after partial read. This can lead to excessive resource consumption (high CPU usage and memory allocation) on the client side.

The urllib3 Python library versions 1.22 through 2.6.2 incorrectly decompresses entire HTTP redirect response bodies even when using the streaming API. This enables a decompression bomb attack leading to excessive client resource consumption.

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation, resulting in excessive resource consumption (high CPU usage and massive memory allocation).

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.