High · published January 8, 2026
⚡ An untrusted redirect could balloon your resource consumption! In urllib3 versions 1.22 to 2.6.3, the library awkwardly hoards data from HTTP redirects, making it vulnerable to overwhelming decompression attacks. 🔥 Think of it like a restaurant that serves large portions but insists on serving you every single appetizer, side, and dessert before you even place your main order. The table gets crowded, and you might just drown in excess! If a malicious server triggers this bug, it could lead to exhausting your system's resources, or even crashing your application. Imagine your server struggling to breathe under the weight of an enormous food order it NEVER asked for—absolutely devastating!
Think of it like a restaurant that serves large portions but insists on serving you every single appetizer, side, and dessert before you even place your main order. The table gets crowded, and you might just drown in excess! This vulnerability in urllib3 allows a malicious server to exploit HTTP redirects by making the library decompress unnecessary data, leading to potential resource exhaustion. The decompression occurs before any read methods are invoked, putting applications at risk when streaming content from untrusted sources.
If a malicious server triggers this bug, it could lead to exhausting your system's resources, or even crashing your application. Imagine your server struggling to breathe under the weight of an enormous food order it NEVER asked for—absolutely devastating! Update urllib3 to at least version 2.6.3 to eliminate the decompression of redirect responses when `preload_content=False`. If upgrading isn’t an option right away, disable redirects by setting `redirect=False` for requests to untrusted sources. You've got this! With these steps, you can fortify your defenses and keep your application running smoothly. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| python/urllib3 | ≥ 1.22, < 2.6.3 | 2.6.3 |