CVE-2025-66471

Name	CVE-2025-66471
Description	urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1122029

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-urllib3 (PTS)	bullseye	1.26.5-1~exp1	vulnerable
	bullseye (security)	1.26.5-1~exp1+deb11u2	vulnerable
	bookworm	1.26.12-1+deb12u1	vulnerable
	trixie	2.3.0-3	vulnerable
	forky, sid	2.5.0-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
python-urllib3	source	(unstable)	(unfixed)			1122029

Notes

[bookworm] - python-urllib3 <ignored> (Intrusive to backport; requires update for src:brotli for effective fix)
[bullseye] - python-urllib3 <ignored> (Intrusive to backport; requires update for src:brotli for effective fix)
https://www.openwall.com/lists/oss-security/2025/12/05/4
https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37
Fixed by: https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7 (2.6.0)
The fix requires an updated src:brotli >= 1.2.0 for the fix to be effective,
which adds the optional output_buffer_limit option to avoid these attacks.