Is CVE-2026-21441 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-21441 being exploited in the wild.

How severe is CVE-2026-21441?

High severity, with a CVSS score of 7.5, published 7 January 2026.

Which products and versions are affected?

urllib3 (PyPI) ECOSYSTEM:introduced=1.22,fixed=2.6.3.

Is there a fix for CVE-2026-21441?

Yes. urllib3 (PyPI): upgrade to 2.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-21441 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-21441?

Check whether you run urllib3 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-21441: Python urllib3 denial of service via decompression bomb in redirects

CVE-2026-21441 · Severity: high · CVSS 7.5 · Published 2026-01-07

urllib3 is a widely used Python library for making web requests. A vulnerability in how it handles redirected web traffic allows a malicious server to send a "decompression bomb"—a small file that expands into a massive amount of data when opened. This can cause an application to crash or become unresponsive by exhausting its memory and processing power.

Technologies: urllib3 (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-21441 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-21441 being exploited in the wild.
How severe is CVE-2026-21441?: High severity, with a CVSS score of 7.5, published 7 January 2026.
Which products and versions are affected?: urllib3 (PyPI) ECOSYSTEM:introduced=1.22,fixed=2.6.3.
Is there a fix for CVE-2026-21441?: Yes. urllib3 (PyPI): upgrade to 2.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-21441 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-21441?: Check whether you run urllib3 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

urllib3 (PyPI): upgrade to 2.6.3 or later
```
pip install "urllib3>=2.6.3"
```

Technical details

A vulnerability exists in urllib3's streaming API (specifically when `preload_content=False`) where the library fails to honor decompression limits during HTTP redirects. When a redirect occurs, the library attempts to "drain" the connection by reading and decompressing the entire response body before the user-defined read methods are even called. Because this process bypasses standard safeguards and read limits, a malicious server can return a compressed payload (e.g., gzip, deflate, zstd) that expands to an extreme size, leading to excessive CPU and memory consumption (CWE-409). The issue is fixed in version 2.6.3, which disables automatic decoding of redirect responses when streaming is enabled.

Affected products

Python urllib3 >=1.22, <2.6.3

Identifiers

CVE-2026-21441
GHSA-38jv-5279-wg99
PYSEC-2026-1996

Timeline

2026-01-07: advisory: GitHub Security Advisory published
2026-01-07: disclosed
2026-01-07: patched: Fixed in version 2.6.3
2026-01-23: other: Debian LTS security update released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.