CVE-2026-9375 - High Severity Vulnerability
Vulnerable Library - urllib3-2.6.3-py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260402140528_BYRDYW/python_TYRXAX/20260402140530/urllib3-2.6.3-py3-none-any.whl,/tmp/ws-ua_20260402140528_BYRDYW/python_TYRXAX/20260402140530/urllib3-2.6.3-py3-none-any.whl
Dependency Hierarchy:
- ❌ urllib3-2.6.3-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 0ef017910357920860e070034f01429aa45746e4
Found in base branch: main
Vulnerability Details
urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API ("preload_content=False") when using Brotli support. The issue arises due to three independent code paths in "response.py" that bypass the "max_length" protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative "max_length" values can be produced due to buffer arithmetic in "read()", "flush_decoder" unconditionally overrides "max_length" to "-1", and "_flush_decoder()" passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using "requests" or "urllib3" to stream content from untrusted sources.
Publish Date: 2026-06-19
URL: CVE-2026-9375
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-06-19
Fix Resolution: 2.7.0
Step up your Open Source Security Game with Mend here
CVE-2026-9375 - High Severity Vulnerability
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260402140528_BYRDYW/python_TYRXAX/20260402140530/urllib3-2.6.3-py3-none-any.whl,/tmp/ws-ua_20260402140528_BYRDYW/python_TYRXAX/20260402140530/urllib3-2.6.3-py3-none-any.whl
Dependency Hierarchy:
Found in HEAD commit: 0ef017910357920860e070034f01429aa45746e4
Found in base branch: main
urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API ("preload_content=False") when using Brotli support. The issue arises due to three independent code paths in "response.py" that bypass the "max_length" protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative "max_length" values can be produced due to buffer arithmetic in "read()", "flush_decoder" unconditionally overrides "max_length" to "-1", and "_flush_decoder()" passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using "requests" or "urllib3" to stream content from untrusted sources.
Publish Date: 2026-06-19
URL: CVE-2026-9375
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Release Date: 2026-06-19
Fix Resolution: 2.7.0
Step up your Open Source Security Game with Mend here