Technical impact
The vulnerability causes an infinite loop when urllib3 processes a chunked response that is deflate‑encoded and contains trailing bytes after the stream ends. When the Deflate decoder consumes these trailing bytes, it repeatedly attempts to decode them without making further progress, leading to excessive CPU usage and a request that never completes. Because the socket read is never invoked again, even network read timeouts cannot break the loop.
Affected Systems
Python applications that use urllib3 versions 2.6.2 through 2.7.x, including the HTTPResponse.stream and HTTPResponse.read_chunked methods with content decoding enabled, are affected. Any client that relies on urllib3 to fetch data from untrusted servers and processes responses with Transfer‑Encoding: chunked and Content‑Encoding: deflate may trigger the loop if the server delivers a compressed chunked response with trailing bytes.
Risk and Exploitability
The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the loop by sending a crafted deflate response with trailing bytes to an unsuspecting urllib3 client. The exploit requires only network access to the vulnerable client; no privileged access or complex preparation is needed. The resulting denial of service may consume all CPU resources, stall requests, and degrade application availability.
Github GHSA