Decompression Bomb Bypass in urllib3 Affects Streaming API with Brotli Support

CVE-2026-9375

What is CVE-2026-9375?

A vulnerability in urllib3 version 2.6.3 exists that allows a decompression bomb bypass within its streaming API when Brotli support is enabled. The issue is a result of three distinct code paths in response.py that circumvent the max_length protection established in version 2.6.0 to address previous vulnerabilities. Negative max_length values can be generated through buffer arithmetic during the read operation, while flush_decoder unconditionally overrides max_length to -1. Furthermore, the _flush_decoder() function does not enforce any limits, effectively allowing unlimited decompression. This vulnerability may be exploited by a malicious HTTP server to induce an out-of-memory (OOM) condition, potentially causing a denial of service (DoS) in applications utilizing urllib3 or requests to stream data from unverified sources.

References