Executive brief
urllib3 is a popular Python HTTP client library used by millions of applications to fetch web content. When applications use urllib3's streaming API to read large compressed files or responses (e.g., gzip, brotli-compressed data), the library can decompress far more data than requested, causing extreme memory usage and CPU consumption on the client. An attacker hosting a malicious compressed file or response could trigger this behavior to exhaust system resources and crash the application.
Technical details
The vulnerability is a resource exhaustion issue (CWE-409) in urllib3's streaming decompression logic. When the application calls `stream()`, `read(amt=256)`, or similar methods on a compressed HTTP response, urllib3 reads and decompresses data to fulfill the requested chunk size. However, the library does not properly bound the decompression operation; highly compressed payloads can expand dramatically during a single decompression call, causing excessive memory allocation and CPU consumption despite only a small amount of data being requested. Attack vector is network-based and requires the application to stream untrusted compressed content. The vulnerability affects urllib3 versions 2.5.0 and earlier. Patched versions (2.6.0+) limit decompression to the requested amount.
Affected products
- urllib3 urllib3 2.5.0 and earlier
- Google Brotli prior to 1.2.0
- brotlicffi brotlicffi prior to 1.2.0.0
Timeline
- 2025-12-05: disclosed: Public advisory GHSA-2xpw-w6gg-jr37 released
- 2025-12-05: patched: urllib3 v2.6.0 patched; Brotli 1.2.0 and brotlicffi 1.2.0.0 recommended