Source: python-urllib3 Version: 2.6.3-2 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for python-urllib3. CVE-2026-9375[0]: | urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass | in its streaming API (`preload_content=False`) when using Brotli | support. The issue arises due to three independent code paths in | `response.py` that bypass the `max_length` protection introduced in | version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative | `max_length` values can be produced due to buffer arithmetic in | `read()`, `flush_decoder` unconditionally overrides `max_length` to | `-1`, and `_flush_decoder()` passes no limit at all, defaulting to | unlimited decompression. This allows a malicious HTTP server to | trigger an out-of-memory (OOM) condition by decompressing large | payloads into memory, leading to a denial of service (DoS). The | vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts | applications and libraries using `requests` or `urllib3` to stream | content from untrusted sources. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-9375 https://www.cve.org/CVERecord?id=CVE-2026-9375 [1] https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a Please adjust the affected versions in the BTS as needed. Regards, Salvatore
