Skip to content
OpenAdvisories
High · 8.9 CVE-2025-66418 EUVD-2025-201421GHSA-gm62-xv2j-4w53PYSEC-2026-1998

urllib3 allows an unbounded number of links in the decompression chain

Published Dec 5, 2025 · Updated Nov 10, 2026 · Assigned by GitHub_M

Vendor: urllib3 Product: urllib3 Package: airflow-3 Package: airflow-3-bitnami-compat Package: airflow-3-compat Package: airflow-3-iamguarded-compat Package: az Package: confluent-docker-utils Package: dask-gateway Package: dask-gateway-server Package: dask-kubernetes Package: datadog-agent-7.72 Package: datadog-agent-7.72-core-integrations Package: datadog-agent-7.73 Package: datadog-agent-7.73-core-integrations Package: datadog-agent-7.77 Package: datadog-agent-7.77-core-integrations Package: emissary Package: emissary-apiext Package: emissary-oci-entrypoint Package: ggshield Package: jupyter-base-notebook Package: jupyter-docker-base Package: jupyter-docker-stacks Package: jwt-tool Package: k8s-sidecar Package: katib-earlystopping Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: kserve Package: kserve-agent Package: kserve-agent-compat Package: kserve-manager Package: kserve-manager-compat Package: kserve-qpext Package: kserve-qpext-compat Package: kserve-router Package: kserve-router-compat Package: kserve-storage-controller Package: kubeflow-jupyter-web-app Package: kubeflow-pipelines Package: kubeflow-pipelines-cache_server Package: kubeflow-pipelines-frontend Package: kubeflow-pipelines-metadata-envoy-config Package: kubeflow-pipelines-metadata-writer Package: kubeflow-pipelines-metadata-writer-compat Package: kubeflow-pipelines-persistence_agent Package: kubeflow-pipelines-scheduledworkflow Package: kubeflow-pipelines-viewer-crd-controller Package: kubeflow-pipelines-visualization-server Package: kubeflow-volumes-web-app Package: open-webui Package: py3-cassandra-medusa Package: py3-semgrep Package: py3-supported-urllib3 Package: py3-urllib3 Package: py3-urllib3 Package: py3.10-ambassador Package: py3.10-pip-base Package: py3.10-pipenv Package: py3.10-urllib3 Package: py3.11-ambassador Package: py3.11-pip-base Package: py3.11-pipenv Package: py3.11-urllib3 Package: py3.12-ambassador Package: py3.12-pip-base Package: py3.12-pipenv Package: py3.12-urllib3 Package: py3.13-ambassador Package: py3.13-pip-base Package: py3.13-pipenv Package: py3.13-urllib3 Package: py3.14-pip-base Package: pypy-3.10 Package: pypy-3.11 Package: python-pip Package: python-urllib3 Package: python-urllib3 Package: python-urllib3 Package: semgrep Package: urllib3 Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu Ecosystem: Wolfi

Description

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

Affected products

VendorProductAffectedFixed
urllib3 urllib3 >= 1.24, < 2.6.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 python-urllib3 2.5.0-1.1 —
Debian 13 python-urllib3 2.3.0-3+deb13u1 DSA-6102-1
Debian 12 python-urllib3 1.26.12-1+deb12u2 DSA-6102-1
Debian 11 python-urllib3 1.26.5-1~exp1+deb11u2 DLA-4421-1
ReleasePackageFixed inAdvisory
Ubuntu 26.10 python-pip No fix yet —
Ubuntu 26.04 LTS python-urllib3 2.5.0-1ubuntu1 —
Ubuntu 25.10 python-pip No fix yet —
Ubuntu 25.10 python-urllib3 2.3.0-3ubuntu0.1 USN-7927-1
Ubuntu 24.04 LTS python-urllib3 2.0.7-1ubuntu0.3 USN-7927-1
Ubuntu 22.04 LTS python-urllib3 1.26.5-1~exp1ubuntu0.4 USN-7927-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS python-pip 24.0+dfsg-1ubuntu1.3+esm1 —
Ubuntu Pro 22.04 LTS python-pip 22.0.2+dfsg-1ubuntu0.7+esm1 —
Ubuntu Pro 20.04 LTS python-urllib3 1.25.8-2ubuntu0.4+esm2 USN-7927-1
ReleasePackageFixed inAdvisory
RHEL 10 python-urllib3 +1 1.26.19-2.el10_1.1 RHSA-2026:1086
RHEL 9 fence-virt +56 4.10.0-98.el9_7.4 RHSA-2026:1239
RHEL 9 python-urllib3 +1 1.26.5-6.el9_7.1 RHSA-2026:1087
RHEL 9 python3.11-urllib3 1.26.12-5.el9_7.1 RHSA-2026:1089
RHEL 9 python3.12-urllib3 1.26.19-1.el9_7.1 RHSA-2026:1088
RHEL 8 fence-agents +48 4.2.1-129.el8_10.20 RHSA-2026:1240
RHEL 8 python-urllib3 +1 1.24.2-9.el8_10 RHSA-2026:1254
RHEL 8 python3.11-urllib3 1.26.12-6.el8_10 RHSA-2026:1224
RHEL 8 python3.12-urllib3 1.26.19-2.el8_10 RHSA-2026:1226
RHEL 8 resource-agents +3 4.9.0-54.el8_10.27 RHSA-2026:1241
RHEL 7 python-s3transfer 0.1.13-1.el7_9.3 RHSA-2026:1337
RHEL 7 resource-agents +2 4.1.1-61.el7_9.21 RHSA-2026:1336
Show 19 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Satellite Capsule 6 python-urllib3 +1 2.6.3-0.1.el8pc RHSA-2026:2765, RHSA-2026:2764
Red Hat Satellite 6 python-urllib3 +1 2.6.3-0.1.el8pc RHSA-2026:2765, RHSA-2026:2764
Red Hat Rhui 4 python-urllib3 +1 2.6.3-1.el8ui RHSA-2026:1485
Red Hat Rhel Extras Sap Hana Els 7 resource-agents +1 4.1.1-61.el7_9.21 RHSA-2026:1336
Red Hat Rhel Extras Sap Hana Els 7 resource-agents-sap-hana-scaleout 0.164.0-6.el7_9.21 RHSA-2026:1336
Red Hat Rhel Extras Sap Els 7 resource-agents +1 4.1.1-61.el7_9.21 RHSA-2026:1336
Red Hat Rhel Extras Sap Els 7 sap-cluster-connector 3.0.1-37.el7_9.21 RHSA-2026:1336
RHEL 10.0 EUS python-urllib3 +1 1.26.19-2.el10_0.1 RHSA-2026:1726
RHEL 9.6 EUS fence-virt +56 4.10.0-86.el9_6.13 RHSA-2026:1332
RHEL 9.6 EUS python-urllib3 +1 1.26.5-6.el9_6.1 RHSA-2026:1729
RHEL 9.6 EUS python3.11-urllib3 1.26.12-5.el9_6.1 RHSA-2026:1704
RHEL 9.6 EUS python3.12-urllib3 1.26.19-1.el9_6.1 RHSA-2026:1619
RHEL 9.4 EUS fence-virt +56 4.10.0-62.el9_4.20 RHSA-2026:1331
RHEL 9.4 EUS python-urllib3 +1 1.26.5-5.el9_4.3 RHSA-2026:1674
RHEL 9.4 EUS python3.11-urllib3 1.26.12-2.el9_4.3 RHSA-2026:1712
RHEL 9.4 EUS python3.12-urllib3 1.26.18-2.el9_4.2 RHSA-2026:1957
RHEL 9.2 E4S fence-virt +56 4.10.0-43.el9_2.17 RHSA-2026:1330
RHEL 9.2 E4S python-urllib3 +1 1.26.5-3.el9_2.3 RHSA-2026:1693
RHEL 9.2 E4S python3.11-urllib3 1.26.12-1.el9_2.2 RHSA-2026:1546
RHEL 9.0 E4S fence-virt +57 4.10.0-20.el9_0.26 RHSA-2026:1329
RHEL 9.0 E4S python-urllib3 +1 1.26.5-3.el9_0.2 RHSA-2026:1618
RHEL 8.8 TUS fence-agents +46 4.2.1-112.el8_8.14 RHSA-2026:1701
RHEL 8.8 TUS python-urllib3 +1 1.24.2-5.el8_8.3 RHSA-2026:2718
RHEL 8.8 TUS python3.11-urllib3 1.26.12-1.el8_8.3 RHSA-2026:1676
RHEL 8.8 TUS resource-agents +3 4.9.0-40.el8_8.14 RHSA-2026:1339
RHEL 8.8 E4S fence-agents +47 4.2.1-112.el8_8.14 RHSA-2026:1701
RHEL 8.8 E4S python-urllib3 +1 1.24.2-5.el8_8.3 RHSA-2026:2718
RHEL 8.8 E4S python3.11-urllib3 1.26.12-1.el8_8.3 RHSA-2026:1676
RHEL 8.8 E4S resource-agents +3 4.9.0-40.el8_8.14 RHSA-2026:1339
RHEL 8.6 TUS fence-agents +46 4.2.1-89.el8_6.19 RHSA-2026:1702
RHEL 8.6 TUS python-urllib3 +1 1.24.2-5.el8_6.4 RHSA-2026:2717
RHEL 8.6 TUS resource-agents +3 4.9.0-16.el8_6.18 RHSA-2026:1340
RHEL 8.6 E4S fence-agents +47 4.2.1-89.el8_6.19 RHSA-2026:1702
RHEL 8.6 E4S python-urllib3 +1 1.24.2-5.el8_6.4 RHSA-2026:2717
RHEL 8.6 E4S resource-agents +3 4.9.0-16.el8_6.18 RHSA-2026:1340
RHEL 8.6 AUS fence-agents +42 4.2.1-89.el8_6.19 RHSA-2026:1702
RHEL 8.6 AUS python-urllib3 +1 1.24.2-5.el8_6.4 RHSA-2026:2717
RHEL 8.4 EUS Long Life fence-agents +42 4.2.1-65.el8_4.24 RHSA-2026:2279
RHEL 8.4 EUS Long Life python-urllib3 +1 1.24.2-5.el8_4.1 RHSA-2026:2723
RHEL 8.4 EUS Long Life resource-agents +2 4.1.1-90.el8_4.21 RHSA-2026:1338
RHEL 8.4 AUS fence-agents +45 4.2.1-65.el8_4.24 RHSA-2026:2279
RHEL 8.4 AUS python-urllib3 +1 1.24.2-5.el8_4.1 RHSA-2026:2723
RHEL 8.4 AUS resource-agents +2 4.1.1-90.el8_4.21 RHSA-2026:1338
RHEL 8.2 AUS python-urllib3 +1 1.24.2-4.el8_2.1 RHSA-2026:2728
Red Hat OpenStack 17 python-urllib3 +1 1.26.5-3.el8ost.3 RHSA-2026:28043

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 python3-urllib3 1.26.19-2.el10_1.1 ALSA-2026:1086
AlmaLinux 9 fence-virt +55 4.10.0-98.el9_7.4 ALSA-2026:1239
AlmaLinux 9 python3-urllib3 1.26.5-6.el9_7.1 ALSA-2026:1087
AlmaLinux 9 python3.11-urllib3 1.26.12-5.el9_7.1 ALSA-2026:1089
AlmaLinux 9 python3.12-urllib3 1.26.19-1.el9_7.1 ALSA-2026:1088
AlmaLinux 8 fence-agents-all +47 4.2.1-129.el8_10.20 ALSA-2026:1240
AlmaLinux 8 python3-urllib3 1.24.2-9.el8_10 ALSA-2026:1254
AlmaLinux 8 python3.11-urllib3 1.26.12-6.el8_10 ALSA-2026:1224
AlmaLinux 8 python3.12-urllib3 1.26.19-2.el8_10 ALSA-2026:1226
AlmaLinux 8 resource-agents +3 4.9.0-54.el8_10.27 ALSA-2026:1241

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 python-urllib3 1.26.19-2.el10_1.1 RLSA-2026:1086
Rocky Linux 9 fence-agents 4.10.0-98.el9_7.4 RLSA-2026:1239
Rocky Linux 9 python-urllib3 1.26.5-6.el9_7.1 RLSA-2026:1087
Rocky Linux 9 python3.11-urllib3 1.26.12-5.el9_7.1 RLSA-2026:1089
Rocky Linux 9 python3.12-urllib3 1.26.19-1.el9_7.1 RLSA-2026:1088
Rocky Linux 8 fence-agents 4.2.1-129.el8_10.20 RLSA-2026:1240
Rocky Linux 8 python-urllib3 1.24.2-9.el8_10 RLSA-2026:1254
Rocky Linux 8 python3.11-urllib3 1.26.12-6.el8_10 RLSA-2026:1224
Rocky Linux 8 python3.12-urllib3 1.26.19-2.el8_10 RLSA-2026:1226
Rocky Linux 8 resource-agents 4.9.0-54.el8_10.27 RLSA-2026:1241
ReleasePackageFixed inAdvisory
SLES 15 SP7 python-urllib3 1.25.10-150300.4.21.1 SUSE-SU-2026:0443-1
SLES 15 SP6 python-urllib3 2.0.7-150400.7.27.1 SUSE-SU-2026:0367-2
SLES 15 SP5 python-urllib3 2.0.7-150400.7.27.1 SUSE-SU-2026:0367-2
SLES 15 SP4 python-urllib3 2.0.7-150400.7.27.1 SUSE-SU-2026:0367-2, SUSE-SU-2026:0367-1
SLES 12 SP5 python-urllib3 1.25.10-3.48.4 SUSE-SU-2026:1412-1
Show 16 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 python-urllib3 1.25.10-3.48.4 SUSE-SU-2026:1412-1
SLES 3 python-urllib3 2.0.7-150400.7.27.1 SUSE-SU-2026:0367-1
SLES 3 python-urllib3_1 1.26.18-150600.3.6.1 SUSE-SU-2026:0635-1
SLES for SAP 16.0 python-urllib3 2.5.0-160000.4.1 SUSE-SU-2026:20189-1
SLES for SAP 16.0 python-urllib3_1 1.26.20-160000.3.1 SUSE-SU-2026:20591-1
SLES for SAP 15 SP6 python-urllib3 2.0.7-150400.7.27.1 SUSE-SU-2026:0367-2
SLES for SAP 15 SP5 python-urllib3 2.0.7-150400.7.27.1 SUSE-SU-2026:0367-2
SLES for SAP 15 SP4 python-urllib3 2.0.7-150400.7.27.1 SUSE-SU-2026:0367-2
SLES 16.0 python-urllib3 2.5.0-160000.4.1 SUSE-SU-2026:20189-1
SLES 16.0 python-urllib3_1 1.26.20-160000.3.1 SUSE-SU-2026:20591-1
SLE Micro 6.2 python-urllib3 2.5.0-160000.4.1 SUSE-SU-2026:20175-1
SLE Micro 6.1 python-urllib3 2.1.0-slfo.1.1_4.1 SUSE-SU-2026:20485-1
SLE Micro 6.0 python-urllib3 2.1.0-5.1 SUSE-SU-2026:20443-1
SLE Micro 5.5 python-urllib3 1.25.10-150300.4.21.1 SUSE-SU-2026:0443-1
SLE Micro 5.4 python-urllib3 1.25.10-150300.4.21.1 SUSE-SU-2026:0443-1
SLE Micro 5.3 python-urllib3 1.25.10-150300.4.21.1 SUSE-SU-2026:0443-1
SLE Micro 5.2 python-urllib3 1.25.10-150300.4.21.1 SUSE-SU-2026:0443-1
SLE HPC 15 SP5 python-urllib3 2.0.7-150400.7.27.1 SUSE-SU-2026:0367-2
SLE HPC 15 SP4 python-urllib3 2.0.7-150400.7.27.1 SUSE-SU-2026:0367-2
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed oci-cli 3.76.2-1.1 openSUSE-SU-2026:10539-1
openSUSE Tumbleweed python-oci-sdk 2.168.3-1.1 openSUSE-SU-2026:10431-1
openSUSE Tumbleweed python-urllib3 2.6.2-1.1 openSUSE-SU-2026:10026-1
openSUSE Tumbleweed python-urllib3_1 1.26.20-5.1 openSUSE-SU-2026:10096-1
openSUSE Leap 16.0 python-urllib3 2.5.0-160000.4.1 openSUSE-SU-2026:20127-1
openSUSE Leap 16.0 python-urllib3_1 1.26.20-160000.3.1 openSUSE-SU-2026:20271-1
openSUSE Leap 15.6 python-urllib3 2.0.7-150400.7.27.1 SUSE-SU-2026:0367-1
openSUSE Leap 15.6 python-urllib3_1 1.26.18-150600.3.6.1 SUSE-SU-2026:0635-1
ReleasePackageFixed inAdvisory
Alpine v3.23 py3-urllib3 2.6.3-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 python3-pip +1 21.3.1-2.amzn2023.0.15 ALAS2023-2026-1366
Amazon Linux 2023 python3-urllib3 1.25.10-5.amzn2023.0.6 ALAS2023-2026-1418
Amazon Linux 2023 python3.11-pip +1 22.3.1-2.amzn2023.0.9 ALAS2023-2026-1368
Amazon Linux 2023 python3.12-pip +1 23.2.1-4.amzn2023.0.6 ALAS2023-2026-1367
Amazon Linux 2023 python3.13-pip +1 24.2-259.amzn2023.0.2 ALAS2023-2026-1412
Amazon Linux 2 python-urllib3 1.25.9-1.amzn2.0.7 ALAS2-2026-3156, ALAS2-2025-3110
Amazon Linux 2 python2-pip +2 20.2.2-1.amzn2.0.14 ALAS2-2026-3126
Amazon Linux 2 python3-urllib3 1.25.6-2.amzn2.0.4 ALAS2-2026-3127

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-urllib3 2.0.7-3 —
Azure Linux 2 (CBL-Mariner) python-urllib3 1.26.19-3 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 python3-urllib3 1.26.19-2.el10_1.1 ELSA-2026-1086
Oracle Linux 9 fence-virt +54 4.10.0-98.el9_7.4 ELSA-2026-1239
Oracle Linux 9 python3-urllib3 1.26.5-6.el9_7.1 ELSA-2026-1087
Oracle Linux 9 python3.11-urllib3 1.26.12-5.el9_7.1 ELSA-2026-1089
Oracle Linux 9 python3.12-urllib3 1.26.19-1.el9_7.1 ELSA-2026-1088
Oracle Linux 8 fence-agents-all +41 4.2.1-129.el8_10.20 ELSA-2026-1240
Oracle Linux 8 python3-urllib3 1.24.2-9.el8_10 ELSA-2026-1254
Oracle Linux 8 python3.11-urllib3 1.26.12-6.el8_10 ELSA-2026-1224
Oracle Linux 8 python3.12-urllib3 1.26.19-2.el8_10 ELSA-2026-1226
Oracle Linux 8 resource-agents 4.9.0-54.el8_10.27 ELSA-2026-1241

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling airflow-3 +3 3.1.4-r0 —
Wolfi rolling az 2.81.0-r1 —
Wolfi rolling confluent-docker-utils 0.0.162-r4 —
Wolfi rolling dask-gateway +1 2025.4.0-r7 —
Wolfi rolling dask-kubernetes 2025.7.0-r2 —
Wolfi rolling datadog-agent-7.72 +1 7.72.4-r22 —
Wolfi rolling datadog-agent-7.73 +1 7.73.3-r13 —
Wolfi rolling datadog-agent-7.77 +1 7.77.3-r6 —
Wolfi rolling emissary +6 3.10.0-r14 —
Wolfi rolling ggshield 1.48.0-r0 —
Wolfi rolling jupyter-base-notebook 7.5.0-r1 —
Wolfi rolling jupyter-docker-base +1 999.9.9_git20260925-r0 —
Wolfi rolling jwt-tool 2.3.0-r3 —
Wolfi rolling k8s-sidecar 2.1.4-r1 —
Wolfi rolling katib-earlystopping 0.19.0-r3 —
Wolfi rolling katib-suggestion-hyperopt +5 0.19.0-r13 —
Wolfi rolling kserve +8 0.16.0-r6 —
Wolfi rolling kserve-storage-controller 0.16.0-r3 —
Wolfi rolling kubeflow-jupyter-web-app 1.10.0-r8 —
Wolfi rolling kubeflow-pipelines +8 2.15.0-r4 —
Wolfi rolling kubeflow-pipelines-visualization-server 2.15.0-r0 —
Wolfi rolling kubeflow-volumes-web-app 1.10.0-r6 —
Wolfi rolling open-webui 0.8.12-r4 —
Wolfi rolling py3-cassandra-medusa 0.27.0-r1 —
Wolfi rolling py3-urllib3 +5 2.6.1-r0 —
Wolfi rolling py3.10-pip-base +4 26.1.1-r0 —
Wolfi rolling py3.10-pipenv +3 2026.6.0-r0 —
Wolfi rolling pypy-3.10 7.3.19-r16 —
Wolfi rolling pypy-3.11 7.3.22-r0 —
Wolfi rolling semgrep +1 1.145.0-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI urllib3 >= 1.24, < 2.6.0 2.6.0 GHSA-gm62-xv2j-4w53

Advisories 50

References