CVE-2026-9375 PUBLISHED

Decompression Bomb Bypass via Negative max_length in Streaming API in urllib3

Assigner: @huntr_ai
Reserved: 23.05.2026 Published: 19.06.2026 Updated: 19.06.2026

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (preload_content=False) when using Brotli support. The issue arises due to three independent code paths in response.py that bypass the max_length protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative max_length values can be produced due to buffer arithmetic in read(), flush_decoder unconditionally overrides max_length to -1, and _flush_decoder() passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using requests or urllib3 to stream content from untrusted sources.

Metrics

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Product Status

Vendor urllib3
Product urllib3/urllib3
Versions
  • affected from unspecified to 2.7.0 (excl.)

References

Problem Types

  • CWE-400 Uncontrolled Resource Consumption CWE