Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Published: 2026-06-19
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade urllib3 to a version that includes the fix (e.g., 2.6.4 or later).
  • Upgrade Brotli to the latest stable release to ensure compatible decompression logic.
  • Avoid using the streaming API with preload_content=False for untrusted HTTP sources, or use preload_content=True to download content fully.

Generated by OpenCVE AI on June 19, 2026 at 20:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References

No reference.

History

Fri, 14 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Title Decompression Bomb Bypass via Negative max_length in Streaming API in urllib3
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
References
Metrics cvssV3_0

{'score': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Thu, 13 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Description urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources. This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Mon, 22 Jun 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 21 Jun 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Urllib3
Urllib3 urllib3
Vendors & Products Urllib3
Urllib3 urllib3

Fri, 19 Jun 2026 19:15:00 +0000

Type Values Removed Values Added
Description urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.
Title Decompression Bomb Bypass via Negative max_length in Streaming API in urllib3
Weaknesses CWE-400
References
Metrics cvssV3_0

{'score': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Urllib3 Urllib3
cve-icon MITRE

Status: REJECTED

Assigner: @huntr_ai

Published:

Updated: 2026-08-13T14:39:11.942Z

Reserved: 2026-05-23T14:33:21.716Z

Link: CVE-2026-9375

cve-icon Vulnrichment

Updated:

cve-icon NVD

Status : Rejected

Published: 2026-06-19T19:16:36.947

Modified: 2026-08-13T15:20:22.540

Link: CVE-2026-9375

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-20T22:34:39Z

Weaknesses

No weakness.