urllib3 allows an unbounded number of links in the decompression chain
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| urllib3 | urllib3 | affected |
|
No data.
| Vendor | Product | Versions |
|---|---|---|
| Urllib3 | Urllib3 | — |
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4421-1 | python-urllib3 security update |
Debian DSA |
DSA-6102-1 | python-urllib3 security update |
Github GHSA |
GHSA-gm62-xv2j-4w53 | urllib3 allows an unbounded number of links in the decompression chain |
Ubuntu USN |
USN-8344-1 | pip vulnerabilities |
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.731% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Python
Python urllib3 |
|
| CPEs | cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Python
Python urllib3 |
|
| Metrics |
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Urllib3
Urllib3 urllib3 |
|
| Vendors & Products |
Urllib3
Urllib3 urllib3 |
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0. | |
| Title | urllib3 allows an unbounded number of links in the decompression chain | |
| Weaknesses | CWE-770 | |
| References |
| |
| Metrics |
cvssV4_0
|
View source · Bugzilla · JSON
OpenCVE enrichment
Updated: Dec 5, 2025, 8:56 PM
Debian DLA
Debian DSA
Github GHSA
Ubuntu USN