Executive brief
A vulnerability in the popular urllib3 Python library could allow a malicious website to crash an application. By sending a specially crafted compressed response, an attacker can force the application to consume all available memory, leading to a denial of service. This affects systems that use urllib3 or the requests library to stream data from untrusted internet sources.
Technical details
urllib3 2.6.3 is vulnerable to an uncontrolled resource consumption (CWE-400) issue when processing Brotli-compressed streams with `preload_content=False`. The vulnerability stems from three flaws in `response.py` that bypass the `max_length` safety limits introduced in version 2.6.0: buffer arithmetic errors producing negative `max_length` values, `flush_decoder` overriding limits to `-1`, and `_flush_decoder()` defaulting to unlimited decompression. A remote attacker controlling an HTTP server can exploit this to trigger an out-of-memory (OOM) condition. The issue is addressed in version 2.7.0.
Affected products
- urllib3 urllib3 2.6.3
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory