CVE-2025-66418

urllib3 allows an unbounded number of links in the decompression chain

Published Dec 5, 2025 CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed
Description
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4421-1 python-urllib3 security update
Debian DSA Debian DSA DSA-6102-1 python-urllib3 security update
Github GHSA Github GHSA GHSA-gm62-xv2j-4w53 urllib3 allows an unbounded number of links in the decompression chain
Ubuntu USN Ubuntu USN USN-8344-1 pip vulnerabilities
History
Type Values Removed Values Added
First Time appeared Python
Python urllib3
CPEs cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*
Vendors & Products Python
Python urllib3
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Type Values Removed Values Added
First Time appeared Urllib3
Urllib3 urllib3
Vendors & Products Urllib3
Urllib3 urllib3
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.
Title urllib3 allows an unbounded number of links in the decompression chain
Weaknesses CWE-770
References
Metrics cvssV4_0

{'score': 8.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Nov 10, 2026, 4:03 PM
Reserved
Nov 28, 2025, 11:33 PM
Status
Analyzed
Published
Dec 5, 2025, 4:15 PM
Modified
Nov 10, 2026, 5:17 PM
Severity
Important
Public date
Dec 5, 2025, 4:02 PM