urllib3 Flaws Risk Client DoS via Unbounded Decompression and Streaming Resource Exhaustion

The maintainers of urllib3 have issued a security advisory detailing two high-severity vulnerabilities that could allow malicious servers to crash client applications via resource exhaustion. Both flaws carry a CVSS score of 8.9 (High) and affect millions of applications relying on this foundational library.

The first vulnerability, CVE-2025-66418, targets how urllib3 handles compressed data streams, where the number of links in the decompression chain was unbounded, enabling a malicious server to insert an unlimited number of compression steps and force heavy memory and CPU consumption.

The second flaw, CVE-2025-66471, affects the library’s streaming API, where decoding or decompression during streaming can cause the client to fully decode a small amount of highly compressed data in a single operation, leading to excessive resource use.

Any application using urllib3 version 2.5.0 and earlier to request data from untrusted sources is vulnerable, with a fix to upgrade to urllib3 v2.6.0 or later and Brotli users urged to upgrade to Brotli 1.2.0 or brotlicffi 1.2.0.0, or disable automatic content decoding as a temporary measure.