Junglewise Threat Intelligence

CVE-2026-21441: Python urllib3 denial of service via decompression bomb in redirects

CVE-2026-21441 · Severity: high · CVSS 7.5 · Published 2026-01-07

Technologies: urllib3 (PyPI). Vendors: PyPI.

Executive brief

urllib3 is a widely used Python library for making web requests. A vulnerability in how it handles redirected web traffic allows a malicious server to send a "decompression bomb"—a small file that expands into a massive amount of data when opened. This can cause an application to crash or become unresponsive by exhausting its memory and processing power.

Technical details

A vulnerability exists in urllib3's streaming API (specifically when `preload_content=False`) where the library fails to honor decompression limits during HTTP redirects. When a redirect occurs, the library attempts to "drain" the connection by reading and decompressing the entire response body before the user-defined read methods are even called. Because this process bypasses standard safeguards and read limits, a malicious server can return a compressed payload (e.g., gzip, deflate, zstd) that expands to an extreme size, leading to excessive CPU and memory consumption (CWE-409). The issue is fixed in version 2.6.3, which disables automatic decoding of redirect responses when streaming is enabled.

Affected products

  • Python urllib3 >=1.22, <2.6.3

Timeline

  • 2026-01-07: advisory: GitHub Security Advisory published
  • 2026-01-07: disclosed
  • 2026-01-07: patched: Fixed in version 2.6.3
  • 2026-01-23: other: Debian LTS security update released

References

Related threats