urllib3's HTTPResponse.read_chunked and HTTPResponse.stream methods allow a malicious server to send an excessively long chunk-size line without a terminating newline, causing the library to buffer the line indefinitely and allocate unbounded memory. This flaw can lead to exhaustion of the client process's memory and result in a denial of service. The weakness is a case of unchecked memory allocation (CWE-770).

The vulnerability affects the urllib3 HTTP client library for Python. All installed versions from 1.10.3 up through the releases prior to 2.8.0 are affected. Version 2.8.0 and later include the fix.

The CVSS score of 8.9 indicates a high severity risk. Although an EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, attackers can exploit it by controlling a server that serves HTTP responses to the vulnerable client. By sending a chunked transfer encoding containing a very long, unterminated chunk-size line, the attacker can trigger an unbounded memory allocation inside the client, potentially causing the process to crash or become unresponsive. The attack vector is network‑based and requires the client to accept responses from a malicious server, which is feasible in many real‑world scenarios where untrusted services are accessed via urllib3.