https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:52:55 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-9375 <p><strong>Affected:</strong> Alpaquita:stream: py3-urllib3</p> <p><strong>Affected:</strong> Alpaquita:stream: py3-urllib3</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-9375 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1032 certfr-2026-avi-1032 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1032 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9375 <p>Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.</p> <p>Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-9375 https://cve.radiocsirt.org/vuln/ghsa-mwq6-fg78-p6cq <p>urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.</p> <p>urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.</p> https://cve.radiocsirt.org/vuln/ghsa-mwq6-fg78-p6cq https://cve.radiocsirt.org/vuln/oesa-2026-2813 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: python-urllib3</p> <p>HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more. Security Fix(es):</p> <p>urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.(CVE-2026-9375)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: python-urllib3</p> <p>HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more. Security Fix(es):</p> <p>urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.(CVE-2026-9375)</p> https://cve.radiocsirt.org/vuln/oesa-2026-2813 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21430-1 <p>Security update for python-urllib3</p> <p>Security update for python-urllib3</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21430-1 https://cve.radiocsirt.org/vuln/rhsa-2026:53459 <p>urllib3: urllib3: Denial of Service via decompression bomb bypass with Brotli support</p> <p>urllib3: urllib3: Denial of Service via decompression bomb bypass with Brotli support</p> https://cve.radiocsirt.org/vuln/rhsa-2026:53459 https://cve.radiocsirt.org/vuln/suse-su-2026:22863-1 <p>Security update for python-urllib3</p> <p>Security update for python-urllib3</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22863-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-9375 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:14.04:LTS: python-urllib3, Ubuntu:Pro:16.04:LTS: python-urllib3, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-urllib3, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: python-urllib3, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:22.04:LTS: python-urllib3, Ubuntu:Pro:22.04:LTS: python-pip and 6 more</p> <p>Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:14.04:LTS: python-urllib3, Ubuntu:Pro:16.04:LTS: python-urllib3, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-urllib3, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: python-urllib3, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:22.04:LTS: python-urllib3, Ubuntu:Pro:22.04:LTS: python-pip and 6 more</p> <p>Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-9375