# CVE-2026-9375: urllib3 denial of service via Brotli decompression bomb bypass

Source: https://junglewise.ai/threats/cve-2026-9375-urllib3-denial-of-service-via-brotli-decompression-bomb-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-9375 · Severity: high · CVSS 7.5 · Published 2026-06-19

A vulnerability in the popular urllib3 Python library could allow a malicious website to crash an application. By sending a specially crafted compressed response, an attacker can force the application to consume all available memory, leading to a denial of service. This affects systems that use urllib3 or the requests library to stream data from untrusted internet sources.

## Quick answers

**Is CVE-2026-9375 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9375 being exploited in the wild.

**How severe is CVE-2026-9375?** High severity, with a CVSS score of 7.5, published 19 June 2026.

**Which products and versions are affected?** urllib3 urllib3 2.6.3.

**Is there a fix for CVE-2026-9375?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9375 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9375?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

urllib3 2.6.3 is vulnerable to an uncontrolled resource consumption (CWE-400) issue when processing Brotli-compressed streams with `preload_content=False`. The vulnerability stems from three flaws in `response.py` that bypass the `max_length` safety limits introduced in version 2.6.0: buffer arithmetic errors producing negative `max_length` values, `flush_decoder` overriding limits to `-1`, and `_flush_decoder()` defaulting to unlimited decompression. A remote attacker controlling an HTTP server can exploit this to trigger an out-of-memory (OOM) condition. The issue is addressed in version 2.7.0.

## Affected products

- urllib3 urllib3 2.6.3

## Timeline

- 2026-06-19: disclosed
- 2026-06-19: advisory

## References

- [https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a](https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a)
- [https://huntr.com/bounties/ddd09eb9-b87d-4a43-84df-48837b1bbc23](https://huntr.com/bounties/ddd09eb9-b87d-4a43-84df-48837b1bbc23)