urllib3’s streaming API, which reads HTTP responses in chunks, was found to decompress the entire body of HTTP redirect responses before any application read method was invoked. This bypassed the library’s safeguard against decompression bombs, allowing a malicious server to trigger large decompression operations that consume excessive CPU and memory on the client. The flaw is a classical example of resource exhaustion, captured by CWE-409.

The vulnerability affects any application that uses the urllib3 client library between versions 1.22 up to, but not including, 2.6.3. These include instance libraries and applications written in Python that perform streaming HTTP requests, particularly when they enable automatic redirects and set preload_content=False to avoid unnecessary data loading.

The CVSS score of 8.9 indicates high severity, while the EPSS score of less than 1% shows a low current exploit likelihood in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to serve an HTTP redirect response from an untrusted source that the vulnerable client follows. Once the redirect occurs, the client decompresses the entire response body regardless of content size, potentially leading to denial of service if the payload is sufficiently large. The lack of a read limit for decompressed data allows the attack to scale with the payload size.