Decompression Vulnerability in urllib3 Affects Python HTTP Clients

CVE-2026-21441

What is CVE-2026-21441?

urllib3, an HTTP client library for Python, has a vulnerability that affects its streaming API. This API processes large HTTP responses efficiently by reading them in chunks. However, in versions 1.22 to 2.6.2, for HTTP redirect responses, urllib3 unnecessarily reads and decompresses the entire response body before any read operations. This behavior can be exploited by a malicious server through crafted redirect responses, leading to excessive resource consumption on the client due to decompression bombs. To mitigate the risk, users should upgrade to urllib3 version 2.6.3 or later, which prevents decoding of redirect response content when configured with preload_content=False. Alternatively, clients can disable redirects when working with untrusted sources by setting redirect=False.

References