The vulnerability in urllib3 allows the library to decompress the entire response instead of just the requested portion during certain streaming API calls when Brotli or other compression is used. This causes the client to fully decode a small amount of highly compressed data in a single operation, leading to excessive CPU usage and large memory consumption. The direct impact is a denial‑of‑service condition on the client, potentially bringing an application or system to unresponsiveness when confronted with maliciously compressed input.

Python applications that depend on the urllib3 library, specifically versions from 2.6.0 up to but not including 2.7.0, are affected. The issue applies to any environment where urllib3 processes HTTP responses that may be compressed, such as web clients, API consumers, or any service built on top of urllib3.

The CVSS score is 8.9, indicating high severity. No EPSS score is available, and the vulnerability is not listed as a known exploited vulnerability in the CISA catalog. Attackers can trigger the flaw by sending a specially crafted compressed HTTP response to any client using an affected urllib3 version. Because the exception is triggered during normal decompression operations, the attacker need only communicate with the vulnerable client over HTTP/HTTPS, making the attack vector external and transport‑layer based. The impact is limited to the victim’s system, but overall application availability can be severely disrupted.