Description
urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| urllib3 | urllib3 | >= 2.6.2, < 2.8.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-urllib3 | 2.8.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python-pip | No fix yet | — |
| Ubuntu 26.04 LTS | python-urllib3 | 2.6.3-1ubuntu1.2 | USN-8926-1 |
| Ubuntu 24.04 LTS | python-urllib3 | 2.0.7-1ubuntu0.8 | USN-8926-1 |
| Ubuntu 22.04 LTS | python-urllib3 | 1.26.5-1~exp1ubuntu0.8 | USN-8926-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 24.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 22.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python-urllib3 | 1.25.8-2ubuntu0.4+esm6 | USN-8926-1 |
| Ubuntu Pro 18.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python-urllib3 | 1.22-1ubuntu0.18.04.2+esm5 | USN-8926-1 |
| Ubuntu Pro 16.04 LTS | python-pip | No fix yet | — |
| Ubuntu Pro 14.04 LTS | python-pip | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | python-urllib3 +5 | 2.8.0-1.hum1 | RHSA-2026:69612 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4650-1 |
| SLES 15 SP6 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4704-1, SUSE-SU-2026:4650-1 |
| SLES 15 SP6 | python-urllib3_1 | 1.26.18-150600.3.14.1 | SUSE-SU-2026:4948-1 |
| SLES 15 SP5 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4704-1, SUSE-SU-2026:4650-1 |
| SLES 15 SP4 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4704-1, SUSE-SU-2026:4650-1 |
| SLES 12 SP5 | python-urllib3 | 1.25.10-3.54.1 | SUSE-SU-2026:4649-1 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | python-urllib3 | 1.25.10-3.54.1 | SUSE-SU-2026:4649-1 |
| SLES 3 | python-urllib3 | 2.0.7-150400.7.36.1 | SUSE-SU-2026:4704-1 |
| SLES 3 | python-urllib3_1 | 1.26.18-150600.3.14.1 | SUSE-SU-2026:4948-1 |
| SLES for SAP 16.0 | python-urllib3 | 2.5.0-160000.8.1 | SUSE-SU-2026:24217-1 |
| SLES for SAP 16.0 | python-urllib3_1 | 1.26.20-160000.5.1 | SUSE-SU-2026:24660-1 |
| SLES for SAP 15 SP6 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4704-1, SUSE-SU-2026:4650-1 |
| SLES for SAP 15 SP6 | python-urllib3_1 | 1.26.18-150600.3.14.1 | SUSE-SU-2026:4948-1 |
| SLES for SAP 15 SP5 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4704-1, SUSE-SU-2026:4650-1 |
| SLES for SAP 15 SP4 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4704-1, SUSE-SU-2026:4650-1 |
| SLES 16.0 | python-urllib3 | 2.5.0-160000.8.1 | SUSE-SU-2026:24217-1 |
| SLES 16.0 | python-urllib3_1 | 1.26.20-160000.5.1 | SUSE-SU-2026:24660-1 |
| SLE Micro 6.2 | python-urllib3 | 2.5.0-160000.8.1 | SUSE-SU-2026:24125-1 |
| SLE Micro 5.5 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4650-1 |
| SLE Micro 5.4 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4650-1 |
| SLE Micro 5.3 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4650-1 |
| SLE HPC 15 SP5 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4704-1, SUSE-SU-2026:4650-1 |
| SLE HPC 15 SP4 | python-urllib3 | 1.25.10-150300.4.33.1 | SUSE-SU-2026:4704-1, SUSE-SU-2026:4650-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-urllib3 | 2.8.0-1.1 | openSUSE-SU-2026:12044-1 |
| openSUSE Tumbleweed | python-urllib3_1 | 1.26.20-8.1 | openSUSE-SU-2026:12119-1 |
| openSUSE Leap 16.0 | python-urllib3 | 2.5.0-160000.8.1 | openSUSE-SU-2026:22071-1 |
| openSUSE Leap 16.0 | python-urllib3_1 | 1.26.20-160000.5.1 | openSUSE-SU-2026:22252-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | confluent-docker-utils | 0.0.172-r4 | — |
| Wolfi rolling | datadog-agent-7.77-core-integrations | 7.77.3-r27 | — |
| Wolfi rolling | datadog-agent-7.78 | 7.78.4-r23 | — |
| Wolfi rolling | datadog-agent-7.79 +5 | No fix yet | — |
| Wolfi rolling | datadog-agent-7.81 | 7.81.3-r10 | — |
| Wolfi rolling | jwt-tool | 2.3.0-r7 | — |
| Wolfi rolling | kserve-storage-controller | 0.21.0-r2 | — |
| Wolfi rolling | kubeflow-pipelines-apiserver | 2.17.2-r8 | — |
| Wolfi rolling | kubeflow-pipelines-visualization-server | 2.17.2-r4 | — |
| Wolfi rolling | open-webui | 0.11.4-r3 | — |
| Wolfi rolling | py3-cassandra-medusa | 0.30.1-r2 | — |
| Wolfi rolling | py3.10-pip-base +4 | 26.2.1-r2 | — |
| Wolfi rolling | py3.10-pipenv +3 | 2026.8.0-r2 | — |
| Wolfi rolling | pypy-3.10 | 7.3.19-r21 | — |
| Wolfi rolling | superset-6.0 | 6.0.0-r18 | — |
| Wolfi rolling | superset-6.1 | 6.1.0-r11 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | urllib3 | >= 2.6.2, < 2.8.0 | 2.8.0 | GHSA-gh4c-6fx4-qh6g |
Advisories 13
- SUSE-SU-2026:24660-1 Security update for python-urllib3_1 SUSE / openSUSE Security Updates · Nov 12, 2026
- openSUSE-SU-2026:22252-1 Security update for python-urllib3_1 SUSE / openSUSE Security Updates · Nov 11, 2026
- SUSE-SU-2026:4948-1 Security update for python-urllib3_1 SUSE / openSUSE Security Updates · Nov 2, 2026
- SUSE-SU-2026:24217-1 Security update for python-urllib3 SUSE / openSUSE Security Updates · Oct 21, 2026
- RHSA-2026:69612 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:22071-1 Security update for python-urllib3 SUSE / openSUSE Security Updates · Oct 19, 2026
- USN-8926-1 python-urllib3 vulnerabilities Ubuntu Security Notices (USN) · Oct 17, 2026
- SUSE-SU-2026:4704-1 Security update for python-urllib3 SUSE / openSUSE Security Updates · Oct 17, 2026
- SUSE-SU-2026:4649-1 Security update for python-urllib3 SUSE / openSUSE Security Updates · Oct 14, 2026
- SUSE-SU-2026:4650-1 Security update for python-urllib3 SUSE / openSUSE Security Updates · Oct 14, 2026
- openSUSE-SU-2026:12119-1 python313-urllib3_1-1.26.20-8.1 on GA media SUSE / openSUSE Security Updates · Oct 14, 2026
- SUSE-SU-2026:24125-1 Security update for python-urllib3 SUSE / openSUSE Security Updates · Oct 13, 2026
- openSUSE-SU-2026:12044-1 python313-urllib3-2.8.0-1.1 on GA media SUSE / openSUSE Security Updates · Oct 5, 2026