CVE-2025-66471 urllib3 Streaming API improperly handles highly compressed data

What is CVE-2025-66471?

CVE-2025-66471 is a high-severity denial of service vulnerability in urllib3, published on 5 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.

Weakness: CWE-409

Which versions are affected by CVE-2025-66471?

3 open source packages ship an affected version, including urllib3. It affects 1 product.

Products include Python Urllib3.

How do I fix CVE-2025-66471?

Upgrade urllib3 to 2.6.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-66471 being exploited?

There is no known exploitation of CVE-2025-66471 in the wild and no public exploit code.

Other vulnerabilities in urllib3

• CVE-2026-97689 urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory High 8.9
• CVE-2026-44432 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API High 8.9
• CVE-2026-21441 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) High 8.9
• CVE-2025-66418 urllib3 allows an unbounded number of links in the decompression chain High 8.9
• CVE-2026-44431 urllib3: Sensitive headers forwarded across origins in proxied low-level redirects High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2025-66471, AZL-71837, AZL-71849, BELL-CVE-2025-66471, CLEANSTART-2026-JR23071, CLSA-2026-1770035896 and 37 more.