CVE-2025-66418: urllib3 allows an unbounded number of links in the decompression chain
Impact
urllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, zstd).
However, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.
Affected usages
Applications and libraries using urllib3 version 2.5.0 and earlier for HTTP requests to untrusted sources unless they disable content decoding explicitly.
Remediation
Upgrade to at least urllib3 v2.6.0 in which the library limits the number of links to 5.
If upgrading is not immediately possible, use preloadcontent=False and ensure that resp.headers["content-encoding"] contains a safe number of encodings before reading the response content.
Other sources
urllib3 allows an unbounded number of links in the decompression chain
— Microsoft
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/urllib3to a version that resolves this vulnerability.Fixed in 2.6.0 - Upgrade
Upgrade
debian/python-urllib3to a version that resolves this vulnerability.Fixed in 1.26.5-1~exp1+deb11u3Fixed in 1.26.12-1+deb12u3Fixed in 2.3.0-3+deb13u1Fixed in 2.6.3-2 - Upgrade
Upgrade
urllib3to a version that resolves this vulnerability.Fixed in 2.6.0 - Configuration
If upgrading is not immediately possible, set preload_content=False for HTTP requests to untrusted sources.
urllib3 preload_content = False - Configuration
Ensure resp.headers["content-encoding"] contains a safe number of encodings before reading the response content.
urllib3 resp.headers["content-encoding"] = safe number of encodings
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66418?
CVE-2025-66418 has a high severity level due to the potential for high CPU usage from unbounded decompression steps.
How do I fix CVE-2025-66418?
To fix CVE-2025-66418, upgrade urllib3 to version 2.6.0 or later.
What software is affected by CVE-2025-66418?
CVE-2025-66418 affects urllib3 versions from 1.24 to 2.6.0.
What is the impact of CVE-2025-66418?
The impact of CVE-2025-66418 includes excessive CPU usage that can disrupt service availability.
Is CVE-2025-66418 a denial of service vulnerability?
Yes, CVE-2025-66418 can lead to denial of service due to high CPU consumption.