Improper Handling of Compressed Data in urllib3 Library by Python
CVE-2025-66471

8.9HIGH

Key Information:

Vendor

Urllib3

Status
Urllib3
Vendor
CVE Published:
5 December 2025

What is CVE-2025-66471?

The urllib3 library, a popular HTTP client for Python, exhibits a vulnerability in its Streaming API that mishandles highly compressed data. This flaw affects versions ranging from 1.0 up to 2.5.0. During the processing of compressed responses, the library's logic may result in excessive resource consumption, leading to high CPU usage and substantial memory allocation required for the decompressed data. This occurs when urllib3 attempts to decode compressed data in a single operation, potentially exhausting server resources and impacting performance.

Affected Version(s)

urllib3 >= 1.0, < 2.6.0

References

https://github.com/urllib3/urllib3/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/urllib3/urllib3/commit/c19571de34c47de...
x_refsource_MISC

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.