The vulnerability allows an attacker to bypass the max_length protection in urllib3's streaming API when Brotli is enabled. Negative or omitted max_length values enable unchecked decompression of large payloads, resulting in an out‑of‑memory condition that can crash or hang the application.

Subscribers of urllib3 version 2.6.3, including applications or libraries that use requests or urllib3 to stream content from untrusted HTTP sources, especially those relying on Brotli 1.2.0 compression support. The issue also affects any environment where the affected library calls the streaming API with preload_content=False.

The CVSS score of 7.5 indicates a high level of risk. The lack of an available EPSS value means the exploitation probability is not quantified, but the vulnerability is not yet in the CISA KEV catalog. An attacker can trigger it by hosting malicious HTTP responses with large Brotli‑compressed payloads and directing the vulnerable client to fetch them, forcing the client to allocate memory without boundary checks. The resulting OOM can cause the application to terminate, leading to a denial of service. The attack does not require authentication and can be performed simply by controlling the transmission channel.