https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 12:54:32 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:1086 <p><strong>Affected:</strong> AlmaLinux:10: python3-urllib3</p> <p>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.</p> <p>Security Fix(es):</p> <p>* urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418) * urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:10: python3-urllib3</p> <p>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.</p> <p>Security Fix(es):</p> <p>* urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418) * urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:1086 https://cve.radiocsirt.org/vuln/bdu:2026-03452 bdu:2026-03452 https://cve.radiocsirt.org/vuln/bdu:2026-03452 https://cve.radiocsirt.org/vuln/bell-cve-2025-66471 <p><strong>Affected:</strong> Alpaquita:23: py3-urllib3, Alpaquita:25: py3-urllib3, Alpaquita:stream: py3-urllib3</p> <p><strong>Affected:</strong> Alpaquita:23: py3-urllib3, Alpaquita:25: py3-urllib3, Alpaquita:stream: py3-urllib3</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-66471 https://cve.radiocsirt.org/vuln/brew-abi3audit-cve-2025-66471 <p><strong>Affected:</strong> Homebrew: abi3audit</p> <p>### Impact</p> <p>urllib3&#39;s [streaming API](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.</p> <p>When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation.</p> <p>The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.</p> <p>### Affected usages</p> <p>Applications and libraries using urllib3 version 2.5.0 and earlier to stream large compressed responses or content from untrusted sources.</p> <p>`stream()`, `read(amt=256)`, `read1(amt=256)`, `read_chunked(amt=256)`, `readinto(b)` are examples of `urllib3.HTTPResponse` method calls using the affected logic unless decoding is disabled explicitly.</p> <p>### Remediation</p> <p>Upgrade to at least urllib3 v2.6.0 in which the library avoids decompressing data tha…</p> <p><strong>Affected:</strong> Homebrew: abi3audit</p> <p>### Impact</p> <p>urllib3&#39;s [streaming API](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.</p> <p>When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation.</p> <p>The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.</p> <p>### Affected usages</p> <p>Applications and libraries using urllib3 version 2.5.0 and earlier to stream large compressed responses or content from untrusted sources.</p> <p>`stream()`, `read(amt=256)`, `read1(amt=256)`, `read_chunked(amt=256)`, `readinto(b)` are examples of `urllib3.HTTPResponse` method calls using the affected logic unless decoding is disabled explicitly.</p> <p>### Remediation</p> <p>Upgrade to at least urllib3 v2.6.0 in which the library avoids decompressing data tha…</p> https://cve.radiocsirt.org/vuln/brew-abi3audit-cve-2025-66471 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0109 certfr-2026-avi-0109 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0109 https://cve.radiocsirt.org/vuln/euvd-2026-262689 EUVD-2026-262689 https://cve.radiocsirt.org/vuln/euvd-2026-262689 https://cve.radiocsirt.org/vuln/fkie_cve-2025-66471 <p>urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3&#39;s streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.</p> <p>urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3&#39;s streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-66471 https://cve.radiocsirt.org/vuln/ghsa-2xpw-w6gg-jr37 <p><strong>Affected:</strong> PyPI: urllib3</p> <p>### Impact</p> <p>urllib3&#39;s [streaming API](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.</p> <p>When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation.</p> <p>The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.</p> <p>### Affected usages</p> <p>Applications and libraries using urllib3 version 2.5.0 and earlier to stream large compressed responses or content from untrusted sources.</p> <p>`stream()`, `read(amt=256)`, `read1(amt=256)`, `read_chunked(amt=256)`, `readinto(b)` are examples of `urllib3.HTTPResponse` method calls using the affected logic unless decoding is disabled explicitly.</p> <p>### Remediation</p> <p>Upgrade to at least urllib3 v2.6.0 in which the library avoids decompressing data tha…</p> <p><strong>Affected:</strong> PyPI: urllib3</p> <p>### Impact</p> <p>urllib3&#39;s [streaming API](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.</p> <p>When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation.</p> <p>The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.</p> <p>### Affected usages</p> <p>Applications and libraries using urllib3 version 2.5.0 and earlier to stream large compressed responses or content from untrusted sources.</p> <p>`stream()`, `read(amt=256)`, `read1(amt=256)`, `read_chunked(amt=256)`, `readinto(b)` are examples of `urllib3.HTTPResponse` method calls using the affected logic unless decoding is disabled explicitly.</p> <p>### Remediation</p> <p>Upgrade to at least urllib3 v2.6.0 in which the library avoids decompressing data tha…</p> https://cve.radiocsirt.org/vuln/ghsa-2xpw-w6gg-jr37 https://cve.radiocsirt.org/vuln/msrc_cve-2025-66471 msrc_CVE-2025-66471 https://cve.radiocsirt.org/vuln/msrc_cve-2025-66471 https://cve.radiocsirt.org/vuln/oesa-2026-1249 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: python-urllib3</p> <p>HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more. Security Fix(es):</p> <p>urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3&amp;apos;s streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.(CVE-2025-66471)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: python-urllib3</p> <p>HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more. Security Fix(es):</p> <p>urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3&amp;apos;s streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.(CVE-2025-66471)</p> https://cve.radiocsirt.org/vuln/oesa-2026-1249 https://cve.radiocsirt.org/vuln/opensuse-ru-2026:20649-1 <p>Recommended update for python-urllib3</p> <p>Recommended update for python-urllib3</p> https://cve.radiocsirt.org/vuln/opensuse-ru-2026:20649-1 https://cve.radiocsirt.org/vuln/pysec-2026-1994 <p><strong>Affected:</strong> PyPI: urllib3</p> <p>### Impact</p> <p>urllib3&#39;s [streaming API](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.</p> <p>When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation.</p> <p>The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.</p> <p>### Affected usages</p> <p>Applications and libraries using urllib3 version 2.5.0 and earlier to stream large compressed responses or content from untrusted sources.</p> <p>`stream()`, `read(amt=256)`, `read1(amt=256)`, `read_chunked(amt=256)`, `readinto(b)` are examples of `urllib3.HTTPResponse` method calls using the affected logic unless decoding is disabled explicitly.</p> <p>### Remediation</p> <p>Upgrade to at least urllib3 v2.6.0 in which the library avoids decompressing data tha…</p> <p><strong>Affected:</strong> PyPI: urllib3</p> <p>### Impact</p> <p>urllib3&#39;s [streaming API](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.</p> <p>When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation.</p> <p>The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.</p> <p>### Affected usages</p> <p>Applications and libraries using urllib3 version 2.5.0 and earlier to stream large compressed responses or content from untrusted sources.</p> <p>`stream()`, `read(amt=256)`, `read1(amt=256)`, `read_chunked(amt=256)`, `readinto(b)` are examples of `urllib3.HTTPResponse` method calls using the affected logic unless decoding is disabled explicitly.</p> <p>### Remediation</p> <p>Upgrade to at least urllib3 v2.6.0 in which the library avoids decompressing data tha…</p> https://cve.radiocsirt.org/vuln/pysec-2026-1994 https://cve.radiocsirt.org/vuln/rhsa-2026:0981 <p>crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate urllib3: urllib3 Streaming API improperly handles highly compressed data urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)</p> <p>crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate urllib3: urllib3 Streaming API improperly handles highly compressed data urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)</p> https://cve.radiocsirt.org/vuln/rhsa-2026:0981 https://cve.radiocsirt.org/vuln/suse-ru-2026:21397-1 <p>Recommended update for python-urllib3</p> <p>Recommended update for python-urllib3</p> https://cve.radiocsirt.org/vuln/suse-ru-2026:21397-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-66471 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:14.04:LTS: python-urllib3, Ubuntu:Pro:16.04:LTS: python-urllib3, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-urllib3, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: python-urllib3, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:22.04:LTS: python-urllib3, Ubuntu:Pro:22.04:LTS: python-pip and 6 more</p> <p>urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3&#39;s streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:14.04:LTS: python-urllib3, Ubuntu:Pro:16.04:LTS: python-urllib3, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-urllib3, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: python-urllib3, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:22.04:LTS: python-urllib3, Ubuntu:Pro:22.04:LTS: python-pip and 6 more</p> <p>urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3&#39;s streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-66471 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2927 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in NetApp ActiveIQ Unified Manager ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in NetApp ActiveIQ Unified Manager ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2927