Red Hat Security Advisory: python-urllib3 security update

Fixed packages 2

Vulnerabilities 3

• High 8.9
  CVE-2025-66418

  urllib3 allows an unbounded number of links in the decompression chain

  urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leadin…

  urllib3 urllib3 open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Dec 5, 2025
• High 8.9
  CVE-2025-66471

  urllib3 Streaming API improperly handles highly compressed data

  urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by readi…

  urllib3 urllib3 open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Dec 5, 2025
• High 8.9
  CVE-2026-21441

  urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

  urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decodi…

  urllib3 urllib3 open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jan 7, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419455
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419467
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2427726
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1674.json
• report
  https://access.redhat.com/security/cve/CVE-2025-66418
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-66418
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-66418
• article
  https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8
• article
  https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53
• report
  https://access.redhat.com/security/cve/CVE-2025-66471
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-66471
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-66471
• article
  https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7
• article
  https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37
• report
  https://access.redhat.com/security/cve/CVE-2026-21441
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-21441
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-21441
• article
  https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b
• article
  https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99