Summary
USN-7927-1 fixed vulnerabilities in urllib3. The update for CVE-2025-66471
introduced a regression in the zstd decompression component inside urllib3.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Illia Volochii discovered that urllib3 did not limit the steps in a
decompression chain. An attacker could possibly use this issue to cause
urllib3 to use excessive resources, causing a denial of service.
(CVE-2025-66418)
Rui Xi discovered that urllib3 incorrectly handled highly compressed data.
An attacker could possibly use this issue to cause urllib3 to use
excessive resources, causing a denial of service. This issue only affected
Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-66471)
For the brotli encoding, the fix for CVE-2025-66471 requires an additional
security update in the brotli package.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | python-urllib3 | 2.0.7-1ubuntu0.5 |
| Ubuntu · 25.10 | python-urllib3 | 2.3.0-3ubuntu0.3 |
Vulnerabilities 1
-
High 8.9
urllib3 Streaming API improperly handles highly compressed data
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by readi…