CVE-2025-66418: urllib3 allows an unbounded number of links in the decompression chain

Published Dec 5, 2025
·
Updated

Impact

urllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, zstd).

However, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.

Affected usages

Applications and libraries using urllib3 version 2.5.0 and earlier for HTTP requests to untrusted sources unless they disable content decoding explicitly.

Remediation

Upgrade to at least urllib3 v2.6.0 in which the library limits the number of links to 5.

If upgrading is not immediately possible, use preloadcontent=False and ensure that resp.headers["content-encoding"] contains a safe number of encodings before reading the response content.

Other sources

urllib3 allows an unbounded number of links in the decompression chain

Microsoft

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

MITRE

Affected Software

10 affected componentsFixes available
pypi/urllib3>=1.24<2.6.0
pip/urllib3>=1.24<2.6.0
2.6.0
Python urllib3>=1.24<2.6.0
Microsoft azl3 tensorflow 2.16.1-9
Microsoft cbl2 python-virtualenv 20.26.6-2
Microsoft azl3 python-urllib3 2.0.7-2
Microsoft cbl2 python-urllib3 1.26.19-2
debian/python-urllib3<=1.26.5-1~exp1
1.26.5-1~exp1+deb11u31.26.12-1+deb12u32.3.0-3+deb13u12.6.3-2
IBM Db2 Genius Hub<=1.1, 1.1.1, 1.1.2
IBM Agentics<=1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade pip/urllib3 to a version that resolves this vulnerability.

    Fixed in 2.6.0
  2. Upgrade

    Upgrade debian/python-urllib3 to a version that resolves this vulnerability.

    Fixed in 1.26.5-1~exp1+deb11u3Fixed in 1.26.12-1+deb12u3Fixed in 2.3.0-3+deb13u1Fixed in 2.6.3-2
  3. Upgrade

    Upgrade urllib3 to a version that resolves this vulnerability.

    Fixed in 2.6.0
  4. Configuration

    If upgrading is not immediately possible, set preload_content=False for HTTP requests to untrusted sources.

    urllib3 preload_content = False
  5. Configuration

    Ensure resp.headers["content-encoding"] contains a safe number of encodings before reading the response content.

    urllib3 resp.headers["content-encoding"] = safe number of encodings

Event History

Dec 5, 2025
CVE Published
via MITRE·04:02 PM
Data Sourced
via MITRE·04:02 PM
DescriptionWeakness
Data Sourced
via NVD·04:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via Red Hat·05:01 PM
DescriptionSeverityAffected Software
Advisory Published
via GitHub·06:15 PM
Data Sourced
via GitHub·06:15 PM
DescriptionWeaknessAffected Software
Dec 10, 2025
Data Sourced
via Microsoft·01:02 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·01:02 AM
Affected Software
Updated
via Microsoft·01:02 AM
DescriptionSeverity
May 28, 2026
Data Sourced
via Ubuntu·08:17 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·08:18 PM
DescriptionAffected Software
Data Sourced
via Launchpad·08:18 PM
Description
Jul 13, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-66418?

CVE-2025-66418 has a high severity level due to the potential for high CPU usage from unbounded decompression steps.

2

How do I fix CVE-2025-66418?

To fix CVE-2025-66418, upgrade urllib3 to version 2.6.0 or later.

3

What software is affected by CVE-2025-66418?

CVE-2025-66418 affects urllib3 versions from 1.24 to 2.6.0.

4

What is the impact of CVE-2025-66418?

The impact of CVE-2025-66418 includes excessive CPU usage that can disrupt service availability.

5

Is CVE-2025-66418 a denial of service vulnerability?

Yes, CVE-2025-66418 can lead to denial of service due to high CPU consumption.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203