# CVE-2025-66471: urllib3 streaming API improper compression handling

Source: https://junglewise.ai/threats/cve-2025-66471-urllib3-streaming-api-improper-compression-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-05. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2025-66471 · Severity: high · CVSS 7.5 · Published 2025-12-05

urllib3 is a popular Python HTTP client library used by millions of applications to fetch web content. When applications use urllib3's streaming API to read large compressed files or responses (e.g., gzip, brotli-compressed data), the library can decompress far more data than requested, causing extreme memory usage and CPU consumption on the client. An attacker hosting a malicious compressed file or response could trigger this behavior to exhaust system resources and crash the application.

Technologies: [Google Brotli](https://junglewise.ai/threats/technologies/brotli), [urllib3 (PyPI)](https://junglewise.ai/threats/technologies/urllib3). Vendors: [Google](https://junglewise.ai/threats/vendors/google), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-66471 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66471 being exploited in the wild.

**How severe is CVE-2025-66471?** High severity, with a CVSS score of 7.5, published 5 December 2025.

**Which products and versions are affected?** Brotlicffi prior to 1.2.0.0; Google Brotli prior to 1.2.0; urllib3 (PyPI) >= 1.0, < 2.6.0, ECOSYSTEM:introduced=1.0,fixed=2.6.0.

**Is there a fix for CVE-2025-66471?** Yes. urllib3 (PyPI): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-66471 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-66471?** Check whether you run Brotlicffi, Google Brotli or urllib3 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- urllib3 (PyPI): upgrade to 2.6.0 or later

  ```sh
  pip install "urllib3>=2.6.0"
  ```


## Technical details

The vulnerability is a resource exhaustion issue (CWE-409) in urllib3's streaming decompression logic. When the application calls `stream()`, `read(amt=256)`, or similar methods on a compressed HTTP response, urllib3 reads and decompresses data to fulfill the requested chunk size. However, the library does not properly bound the decompression operation; highly compressed payloads can expand dramatically during a single decompression call, causing excessive memory allocation and CPU consumption despite only a small amount of data being requested. Attack vector is network-based and requires the application to stream untrusted compressed content. The vulnerability affects urllib3 versions 2.5.0 and earlier. Patched versions (2.6.0+) limit decompression to the requested amount.

## Affected products

- urllib3 urllib3 2.5.0 and earlier
- Google Brotli prior to 1.2.0
- brotlicffi brotlicffi prior to 1.2.0.0

## Identifiers

- CVE-2025-66471
- GHSA-2xpw-w6gg-jr37
- PYSEC-2026-1994

## Timeline

- 2025-12-05: disclosed: Public advisory GHSA-2xpw-w6gg-jr37 released
- 2025-12-05: patched: urllib3 v2.6.0 patched; Brotli 1.2.0 and brotlicffi 1.2.0.0 recommended

## Related threats

- [Google Brotli buffer overflow in decoder](https://junglewise.ai/threats/cve-2026-111497-a-buffer-overflow-vulnerability-in-the-brotli-decoder-c-dec)
- [urllib3 HTTP client unbounded memory allocation in chunked transfer](https://junglewise.ai/threats/cve-2026-97689-urllib3-is-an-http-client-library-for-python-from-1-10-3-until-2)
- [urllib3 infinite loop in Deflate decoder](https://junglewise.ai/threats/cve-2026-97688-urllib3-is-an-http-client-library-for-python-from-2-6-2-until-2-8)
- [urllib3 HTTPS proxy TLS settings isolation](https://junglewise.ai/threats/cve-2026-97687-urllib3-is-an-http-client-library-for-python-from-1-26-0-until-2)
- [PYSEC-2026-2401 - Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation](https://junglewise.ai/threats/cve-2025-6176-scrapy-denial-of-service-via-brotli-decompression-bomb)