Skip to content
OpenAdvisories
High · 8.9 CVE-2026-21441 EUVD-2026-1188GHSA-38jv-5279-wg99PYSEC-2026-1996

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

Published Jan 7, 2026 · Updated Nov 10, 2026 · Assigned by GitHub_M

Description

urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.

Affected products

VendorProductAffectedFixed
urllib3 urllib3 >= 1.22, < 2.6.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 python-urllib3 2.5.0-2 —
Debian 13 python-urllib3 2.3.0-3+deb13u1 DSA-6102-1
Debian 12 python-urllib3 1.26.12-1+deb12u3 DSA-6102-2, DSA-6102-1
Debian 11 python-urllib3 1.26.5-1~exp1+deb11u3 DLA-4446-1
ReleasePackageFixed inAdvisory
Ubuntu 26.10 python-pip No fix yet —
Ubuntu 25.10 python-pip No fix yet —
Ubuntu 25.10 python-urllib3 2.3.0-3ubuntu0.2 —
Ubuntu 24.04 LTS python-urllib3 2.0.7-1ubuntu0.4 —
Ubuntu 22.04 LTS python-urllib3 1.26.5-1~exp1ubuntu0.5 —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS python-pip No fix yet —
Ubuntu Pro 24.04 LTS python-pip No fix yet —
Ubuntu Pro 22.04 LTS python-pip No fix yet —
Ubuntu Pro 20.04 LTS python-urllib3 1.25.8-2ubuntu0.4+esm3 —
Ubuntu Pro 18.04 LTS python-pip +1 No fix yet —
ReleasePackageFixed inAdvisory
RHEL 10 python-urllib3 +1 1.26.19-2.el10_1.1 RHSA-2026:1086
RHEL 9 fence-virt +56 4.10.0-98.el9_7.4 RHSA-2026:1239
RHEL 9 python-urllib3 +1 1.26.5-6.el9_7.1 RHSA-2026:1087
RHEL 9 python3.11-urllib3 1.26.12-5.el9_7.1 RHSA-2026:1089
RHEL 9 python3.12-urllib3 1.26.19-1.el9_7.1 RHSA-2026:1088
RHEL 8 fence-agents +48 4.2.1-129.el8_10.20 RHSA-2026:1240
RHEL 8 python-urllib3 +1 1.24.2-9.el8_10 RHSA-2026:1254
RHEL 8 python3.11-urllib3 1.26.12-6.el8_10 RHSA-2026:1224
RHEL 8 python3.12-urllib3 1.26.19-2.el8_10 RHSA-2026:1226
RHEL 8 resource-agents +3 4.9.0-54.el8_10.27 RHSA-2026:1241
RHEL 7 python-s3transfer 0.1.13-1.el7_9.6 RHSA-2026:2911
Show 17 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Satellite Capsule 6 python-urllib3 +1 2.6.3-0.1.el8pc RHSA-2026:2765, RHSA-2026:2764
Red Hat Satellite Capsule 6 python3.12-aiohttp 3.13.3-1.el9pc RHSA-2026:2760
Red Hat Satellite Capsule 6 python3.12-urllib3 2.6.3-1.el9pc RHSA-2026:2760
Red Hat Satellite 6 python-urllib3 +1 2.6.3-0.1.el8pc RHSA-2026:2765, RHSA-2026:2764
Red Hat Satellite 6 python3.12-aiohttp 3.13.3-1.el9pc RHSA-2026:2760
Red Hat Satellite 6 python3.12-urllib3 2.6.3-1.el9pc RHSA-2026:2760
Red Hat Rhui 4 python-urllib3 +1 2.6.3-1.el8ui RHSA-2026:1485
RHEL 10.0 EUS python-urllib3 +1 1.26.19-2.el10_0.1 RHSA-2026:1726
RHEL 9.6 EUS fence-virt +56 4.10.0-86.el9_6.14 RHSA-2026:1706
RHEL 9.6 EUS python-urllib3 +1 1.26.5-6.el9_6.1 RHSA-2026:1729
RHEL 9.6 EUS python3.11-urllib3 1.26.12-5.el9_6.1 RHSA-2026:1704
RHEL 9.6 EUS python3.12-urllib3 1.26.19-1.el9_6.1 RHSA-2026:1619
RHEL 9.4 EUS fence-virt +56 4.10.0-62.el9_4.21 RHSA-2026:1717
RHEL 9.4 EUS python-urllib3 +1 1.26.5-5.el9_4.3 RHSA-2026:1674
RHEL 9.4 EUS python3.11-urllib3 1.26.12-2.el9_4.3 RHSA-2026:1712
RHEL 9.4 EUS python3.12-urllib3 1.26.18-2.el9_4.2 RHSA-2026:1957
RHEL 9.2 E4S fence-virt +56 4.10.0-43.el9_2.18 RHSA-2026:1735
RHEL 9.2 E4S python-urllib3 +1 1.26.5-3.el9_2.3 RHSA-2026:1693
RHEL 9.2 E4S python3.11-urllib3 1.26.12-1.el9_2.2 RHSA-2026:1546
RHEL 9.0 E4S fence-virt +57 4.10.0-20.el9_0.27 RHSA-2026:1734
RHEL 9.0 E4S python-urllib3 +1 1.26.5-3.el9_0.2 RHSA-2026:1618
RHEL 8.8 TUS fence-agents +46 4.2.1-112.el8_8.15 RHSA-2026:1791
RHEL 8.8 TUS python-urllib3 +1 1.24.2-5.el8_8.3 RHSA-2026:2718
RHEL 8.8 TUS python3.11-urllib3 1.26.12-1.el8_8.3 RHSA-2026:1676
RHEL 8.8 TUS resource-agents +3 4.9.0-40.el8_8.15 RHSA-2026:1794
RHEL 8.8 E4S fence-agents +47 4.2.1-112.el8_8.15 RHSA-2026:1791
RHEL 8.8 E4S python-urllib3 +1 1.24.2-5.el8_8.3 RHSA-2026:2718
RHEL 8.8 E4S python3.11-urllib3 1.26.12-1.el8_8.3 RHSA-2026:1676
RHEL 8.8 E4S resource-agents +3 4.9.0-40.el8_8.15 RHSA-2026:1794
RHEL 8.6 TUS fence-agents +46 4.2.1-89.el8_6.20 RHSA-2026:1792
RHEL 8.6 TUS python-urllib3 +1 1.24.2-5.el8_6.4 RHSA-2026:2717
RHEL 8.6 TUS resource-agents +3 4.9.0-16.el8_6.19 RHSA-2026:1793
RHEL 8.6 E4S fence-agents +47 4.2.1-89.el8_6.20 RHSA-2026:1792
RHEL 8.6 E4S python-urllib3 +1 1.24.2-5.el8_6.4 RHSA-2026:2717
RHEL 8.6 E4S resource-agents +3 4.9.0-16.el8_6.19 RHSA-2026:1793
RHEL 8.6 AUS fence-agents +42 4.2.1-89.el8_6.20 RHSA-2026:1792
RHEL 8.6 AUS python-urllib3 +1 1.24.2-5.el8_6.4 RHSA-2026:2717
RHEL 8.4 EUS Long Life fence-agents +42 4.2.1-65.el8_4.25 RHSA-2026:1803
RHEL 8.4 EUS Long Life python-urllib3 +1 1.24.2-5.el8_4.1 RHSA-2026:2723
RHEL 8.4 EUS Long Life resource-agents +2 4.1.1-90.el8_4.22 RHSA-2026:1805
RHEL 8.4 AUS fence-agents +45 4.2.1-65.el8_4.25 RHSA-2026:1803
RHEL 8.4 AUS python-urllib3 +1 1.24.2-5.el8_4.1 RHSA-2026:2723
RHEL 8.4 AUS resource-agents +2 4.1.1-90.el8_4.22 RHSA-2026:1805
RHEL 8.2 AUS python-urllib3 +1 1.24.2-4.el8_2.1 RHSA-2026:2728
Red Hat OpenStack 17 python-urllib3 +1 1.26.5-3.el8ost.3 RHSA-2026:28043

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 python3-urllib3 1.26.19-2.el10_1.1 ALSA-2026:1086
AlmaLinux 9 fence-virt +55 4.10.0-98.el9_7.4 ALSA-2026:1239
AlmaLinux 9 python3-urllib3 1.26.5-6.el9_7.1 ALSA-2026:1087
AlmaLinux 9 python3.11-urllib3 1.26.12-5.el9_7.1 ALSA-2026:1089
AlmaLinux 9 python3.12-urllib3 1.26.19-1.el9_7.1 ALSA-2026:1088
AlmaLinux 8 fence-agents-all +47 4.2.1-129.el8_10.20 ALSA-2026:1240
AlmaLinux 8 python3-urllib3 1.24.2-9.el8_10 ALSA-2026:1254
AlmaLinux 8 python3.11-urllib3 1.26.12-6.el8_10 ALSA-2026:1224
AlmaLinux 8 python3.12-urllib3 1.26.19-2.el8_10 ALSA-2026:1226
AlmaLinux 8 resource-agents +3 4.9.0-54.el8_10.27 ALSA-2026:1241

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 python-urllib3 1.26.19-2.el10_1.1 RLSA-2026:1086
Rocky Linux 9 fence-agents 4.10.0-98.el9_7.4 RLSA-2026:1239
Rocky Linux 9 python-urllib3 1.26.5-6.el9_7.1 RLSA-2026:1087
Rocky Linux 9 python3.11-urllib3 1.26.12-5.el9_7.1 RLSA-2026:1089
Rocky Linux 9 python3.12-urllib3 1.26.19-1.el9_7.1 RLSA-2026:1088
Rocky Linux 8 fence-agents 4.2.1-129.el8_10.20 RLSA-2026:1240
Rocky Linux 8 python-urllib3 1.24.2-9.el8_10 RLSA-2026:1254
Rocky Linux 8 python3.11-urllib3 1.26.12-6.el8_10 RLSA-2026:1224
Rocky Linux 8 python3.12-urllib3 1.26.19-2.el8_10 RLSA-2026:1226
Rocky Linux 8 resource-agents 4.9.0-54.el8_10.27 RLSA-2026:1241
ReleasePackageFixed inAdvisory
SLES 15 SP7 python-urllib3 1.25.10-150300.4.21.1 SUSE-SU-2026:0443-1
SLES 15 SP6 python-urllib3 2.0.7-150400.7.24.1 SUSE-SU-2026:0255-2
SLES 15 SP5 python-urllib3 2.0.7-150400.7.24.1 SUSE-SU-2026:0255-2
SLES 15 SP4 python-urllib3 2.0.7-150400.7.24.1 SUSE-SU-2026:0255-2, SUSE-SU-2026:0255-1
SLES 12 SP5 python-urllib3 1.25.10-3.48.4 SUSE-SU-2026:1412-1
Show 16 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 python-urllib3 1.25.10-3.48.4 SUSE-SU-2026:1412-1
SLES 3 python-urllib3 2.0.7-150400.7.24.1 SUSE-SU-2026:0255-1
SLES 3 python-urllib3_1 1.26.18-150600.3.6.1 SUSE-SU-2026:0635-1
SLES for SAP 16.0 python-urllib3 2.5.0-160000.3.1 SUSE-SU-2026:20131-1
SLES for SAP 16.0 python-urllib3_1 1.26.20-160000.3.1 SUSE-SU-2026:20591-1
SLES for SAP 15 SP6 python-urllib3 2.0.7-150400.7.24.1 SUSE-SU-2026:0255-2
SLES for SAP 15 SP5 python-urllib3 2.0.7-150400.7.24.1 SUSE-SU-2026:0255-2
SLES for SAP 15 SP4 python-urllib3 2.0.7-150400.7.24.1 SUSE-SU-2026:0255-2
SLES 16.0 python-urllib3 2.5.0-160000.3.1 SUSE-SU-2026:20131-1
SLES 16.0 python-urllib3_1 1.26.20-160000.3.1 SUSE-SU-2026:20591-1
SLE Micro 6.2 python-urllib3 2.5.0-160000.3.1 SUSE-SU-2026:20157-1
SLE Micro 6.1 python-urllib3 2.1.0-slfo.1.1_3.1 SUSE-SU-2026:20364-1
SLE Micro 6.0 python-urllib3 2.1.0-4.1 SUSE-SU-2026:20270-1
SLE Micro 5.5 python-urllib3 1.25.10-150300.4.21.1 SUSE-SU-2026:0443-1
SLE Micro 5.4 python-urllib3 1.25.10-150300.4.21.1 SUSE-SU-2026:0443-1
SLE Micro 5.3 python-urllib3 1.25.10-150300.4.21.1 SUSE-SU-2026:0443-1
SLE Micro 5.2 python-urllib3 1.25.10-150300.4.21.1 SUSE-SU-2026:0443-1
SLE HPC 15 SP5 python-urllib3 2.0.7-150400.7.24.1 SUSE-SU-2026:0255-2
SLE HPC 15 SP4 python-urllib3 2.0.7-150400.7.24.1 SUSE-SU-2026:0255-2
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed oci-cli 3.76.2-1.1 openSUSE-SU-2026:10539-1
openSUSE Tumbleweed python-urllib3 2.6.3-1.1 openSUSE-SU-2026:10049-1
openSUSE Tumbleweed python-urllib3_1 1.26.20-5.1 openSUSE-SU-2026:10096-1
openSUSE Leap 16.0 python-urllib3 2.5.0-160000.3.1 openSUSE-SU-2026:20088-1
openSUSE Leap 16.0 python-urllib3_1 1.26.20-160000.3.1 openSUSE-SU-2026:20271-1
openSUSE Leap 15.6 python-urllib3 2.0.7-150400.7.24.1 SUSE-SU-2026:0255-1
openSUSE Leap 15.6 python-urllib3_1 1.26.18-150600.3.6.1 SUSE-SU-2026:0635-1
ReleasePackageFixed inAdvisory
Alpine v3.24 py3-urllib3 2.6.3-r0 —
Alpine v3.23 py3-urllib3 2.6.3-r0 —
Alpine v3.22 py3-urllib3 1.26.20-r1 —
Alpine v3.21 py3-urllib3 1.26.20-r1 —
Alpine v3.20 py3-urllib3 1.26.18-r2 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 python3-pip +1 21.3.1-2.amzn2023.0.16 ALAS2023-2026-1416
Amazon Linux 2023 python3-urllib3 1.25.10-5.amzn2023.0.6 ALAS2023-2026-1418
Amazon Linux 2023 python3.11-pip +1 22.3.1-2.amzn2023.0.10 ALAS2023-2026-1408
Amazon Linux 2023 python3.12-pip +1 23.2.1-4.amzn2023.0.7 ALAS2023-2026-1409
Amazon Linux 2023 python3.13-pip +1 24.2-259.amzn2023.0.3 ALAS2023-2026-1413
Amazon Linux 2 python-urllib3 1.25.9-1.amzn2.0.9 ALAS2-2026-3149
Amazon Linux 2 python2-pip +2 20.2.2-1.amzn2.0.15 ALAS2-2026-3147
Amazon Linux 2 python3-urllib3 1.25.6-2.amzn2.0.5 ALAS2-2026-3131

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-urllib3 2.0.7-4 —
Azure Linux 3 tensorflow 2.16.1-10 —
Azure Linux 2 (CBL-Mariner) python-urllib3 1.26.19-3 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 python3-urllib3 1.26.19-2.el10_1.1 ELSA-2026-1086
Oracle Linux 9 fence-virt +54 4.10.0-98.el9_7.4 ELSA-2026-1239
Oracle Linux 9 python3-urllib3 1.26.5-6.el9_7.1 ELSA-2026-1087
Oracle Linux 9 python3.11-urllib3 1.26.12-5.el9_7.1 ELSA-2026-1089
Oracle Linux 9 python3.12-urllib3 1.26.19-1.el9_7.1 ELSA-2026-1088
Oracle Linux 8 fence-agents-all +41 4.2.1-129.el8_10.20 ELSA-2026-1240
Oracle Linux 8 python3-urllib3 1.24.2-9.el8_10 ELSA-2026-1254
Oracle Linux 8 python3.11-urllib3 1.26.12-6.el8_10 ELSA-2026-1224
Oracle Linux 8 python3.12-urllib3 1.26.19-2.el8_10 ELSA-2026-1226
Oracle Linux 8 resource-agents 4.9.0-54.el8_10.27 ELSA-2026-1241

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling airflow-3 3.1.5-r3 —
Wolfi rolling az 2.82.0-r0 —
Wolfi rolling checkov 3.2.499-r0 —
Wolfi rolling confluent-docker-utils 0.0.163-r1 —
Wolfi rolling dask-gateway +1 2025.4.0-r7 —
Wolfi rolling dask-kubernetes 2025.7.0-r5 —
Wolfi rolling datadog-agent-7.72 7.72.4-r6 —
Wolfi rolling datadog-agent-7.72-core-integrations 7.72.4-r22 —
Wolfi rolling datadog-agent-7.73 +1 7.73.3-r13 —
Wolfi rolling datadog-agent-7.77 +1 7.77.3-r6 —
Wolfi rolling ggshield 1.48.0-r0 —
Wolfi rolling jupyter-base-notebook 7.5.2-r0 —
Wolfi rolling jwt-tool 2.3.0-r3 —
Wolfi rolling k8s-sidecar 2.2.3-r1 —
Wolfi rolling katib-earlystopping +6 0.19.0-r13 —
Wolfi rolling kserve-storage-controller 0.16.0-r8 —
Wolfi rolling kubeflow-jupyter-web-app 1.10.0-r9 —
Wolfi rolling kubeflow-pipelines-apiserver 2.15.0-r6 —
Wolfi rolling kubeflow-volumes-web-app 1.10.0-r7 —
Wolfi rolling open-webui 0.8.12-r4 —
Wolfi rolling py3-cassandra-medusa 0.27.0-r1 —
Wolfi rolling py3.10-ambassador 3.10.0-r16 —
Wolfi rolling py3.10-pip-base +4 26.1.1-r0 —
Wolfi rolling py3.10-pipenv +3 2026.6.0-r0 —
Wolfi rolling pypy-3.10 7.3.19-r16 —
Wolfi rolling pypy-3.11 7.3.22-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI urllib3 >= 1.22, < 2.6.3 2.6.3 GHSA-38jv-5279-wg99

Advisories 50

References