Every CVE Search/ Get API key

CVE-2026-9375

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (...

7.5 HighFix availableRejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

What each source reports

GitHub Advisories Score usedGHSA-mwq6-fg78-p6cq 7.5

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (...

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (preload_content=False) when using Brotli support. The issue arises due to three independent code paths in response.py that bypass the max_length protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative max_length values can be produced due to buffer arithmetic in read(), flush_decoder unconditionally overrides max_length to -1, and _flush_decoder() passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using requests or urllib3 to stream content from untrusted sources.

Record
GHSA-mwq6-fg78-p6cq
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
CVE List No score

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Record
CVE-2026-9375
Updated
2026-11-02
EUVDEUVD-2026-38064 7.5

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Record
EUVD-2026-38064
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
NVD No score

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Record
CVE-2026-9375
Updated
2026-11-02
OSVBELL-CVE-2026-9375 7.5
Record
BELL-CVE-2026-9375
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

Decompression Bomb Bypass via Negative max_length in Streaming API in urllib3

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (preload_content=False) when using Brotli support. The issue arises due to three independent code paths in response.py that bypass the max_length protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative max_length values can be produced due to buffer arithmetic in read(), flush_decoder unconditionally overrides max_length to -1, and _flush_decoder() passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using requests or urllib3 to stream content from untrusted sources.

Record
CVE-2026-9375
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
Show 13 moreShow less
OSVDEBIAN-CVE-2026-9375 7.5
Record
DEBIAN-CVE-2026-9375
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2813 7.5

python-urllib3 security update

HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more.

Security Fix(es):

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (preload_content=False) when using Brotli support. The issue arises due to three independent code paths in response.py that bypass the max_length protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative max_length values can be produced due to buffer arithmetic in read(), flush_decoder unconditionally overrides max_length to -1, and _flush_decoder() passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using requests or urllib3 to stream content from untrusted sources.(CVE-2026-9375)

Record
OESA-2026-2813
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2814 7.5

python-urllib3 security update

HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more.

Security Fix(es):

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (preload_content=False) when using Brotli support. The issue arises due to three independent code paths in response.py that bypass the max_length protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative max_length values can be produced due to buffer arithmetic in read(), flush_decoder unconditionally overrides max_length to -1, and _flush_decoder() passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using requests or urllib3 to stream content from untrusted sources.(CVE-2026-9375)

Record
OESA-2026-2814
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2815 7.5

python-urllib3 security update

HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more.

Security Fix(es):

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (preload_content=False) when using Brotli support. The issue arises due to three independent code paths in response.py that bypass the max_length protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative max_length values can be produced due to buffer arithmetic in read(), flush_decoder unconditionally overrides max_length to -1, and _flush_decoder() passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using requests or urllib3 to stream content from untrusted sources.(CVE-2026-9375)

Record
OESA-2026-2815
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2816 7.5

python-urllib3 security update

HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more.

Security Fix(es):

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (preload_content=False) when using Brotli support. The issue arises due to three independent code paths in response.py that bypass the max_length protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative max_length values can be produced due to buffer arithmetic in read(), flush_decoder unconditionally overrides max_length to -1, and _flush_decoder() passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using requests or urllib3 to stream content from untrusted sources.(CVE-2026-9375)

Record
OESA-2026-2816
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:53459 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:53459
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-9375 7.5

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Record
UBUNTU-CVE-2026-9375
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:21430-1 No score

Security update for python-urllib3

This update for python-urllib3 fixes the following issue

  • CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service (bsc#1268683).
Record
openSUSE-SU-2026:21430-1
Updated
2026-11-02
OSVSUSE-SU-2026:22863-1 No score

Security update for python-urllib3

This update for python-urllib3 fixes the following issue

  • CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service (bsc#1268683).
Record
SUSE-SU-2026:22863-1
Updated
2026-11-02
OSVSUSE-SU-2026:22937-1 No score

Security update for python-urllib3

This update for python-urllib3 fixes the following issue

  • CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service (bsc#1268683).
Record
SUSE-SU-2026:22937-1
Updated
2026-11-02
OSVSUSE-SU-2026:23048-1 No score

Security update for python-urllib3

This update for python-urllib3 fixes the following issue:

  • CVE-2026-9375: oversized Brotli payload via the streaming API can lead to a denial of service (bsc#1268683).
Record
SUSE-SU-2026:23048-1
Updated
2026-11-02
OSVSUSE-SU-2026:23176-1 No score

Security update for python-urllib3

This update for python-urllib3 fixes the following issue:

  • CVE-2026-9375: oversized Brotli payload via the streaming API can lead to a denial of service (bsc#1268683).
Record
SUSE-SU-2026:23176-1
Updated
2026-11-02
OSVSUSE-SU-2026:3397-1 No score

Security update for python-urllib3

This update for python-urllib3 fixes the following issue

  • CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service (bsc#1268683).
Record
SUSE-SU-2026:3397-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
py3-urllib3
Alpaquita:stream
 2.6.0-r0 up to 2.7.0-r0
2.7.0-r0
python-urllib3
openEuler:20.03-LTS-SP4
 before 1.25.9-18.oe2003sp4
1.25.9-18.oe2003sp4
python-urllib3
openEuler:22.03-LTS-SP4
 before 1.26.12-14.oe2203sp4
1.26.12-14.oe2203sp4
python-urllib3
openEuler:24.03-LTS-SP1
 before 1.26.18-9.oe2403sp1
1.26.18-9.oe2403sp1
python-urllib3
openEuler:24.03-LTS-SP3
 before 1.26.18-9.oe2403sp3
1.26.18-9.oe2403sp3
python-urllib3
SUSE:Linux Enterprise Server 16.0
 before 2.5.0-160000.7.1
2.5.0-160000.7.1
python-urllib3
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 2.5.0-160000.7.1
2.5.0-160000.7.1
python-urllib3
SUSE:Linux Micro 6.2
 before 2.5.0-160000.7.1
2.5.0-160000.7.1
python-urllib3
SUSE:Linux Micro 6.0
 before 2.1.0-7.1
2.1.0-7.1
python-urllib3
SUSE:Linux Micro 6.1
 before 2.1.0-slfo.1.1_6.1
2.1.0-slfo.1.1_6.1
Show 19 moreShow less
Affected packages
PackageAffectedFixed
python-urllib3
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 2.0.7-150400.7.33.1
2.0.7-150400.7.33.1
python-urllib3
SUSE:Linux Enterprise Module for Python 3 15 SP7
 before 2.0.7-150400.7.33.1
2.0.7-150400.7.33.1
python-pip
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.4.1-21.5.4-11.5.4-1ubuntu11.5.4-1ubuntu31.5.4-1ubuntu4
Show 5 moreShow less
1.5.4-1ubuntu4+esm11.5.4-1ubuntu4+esm21.5.4-1ubuntu4+esm31.5.4-1ubuntu4+esm41.5.4-1ubuntu4+esm5
 None known
python-urllib3
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.6-21.7.1-11.7.1-1build11.7.1-1ubuntu0.11.7.1-1ubuntu31.7.1-1ubuntu41.7.1-1ubuntu4.11.7.1-1ubuntu4.1+esm1
 None known
python-urllib3
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.11-11.12-11.13.1-11.13.1-21.13.1-2ubuntu0.16.04.1
Show 7 moreShow less
1.13.1-2ubuntu0.16.04.21.13.1-2ubuntu0.16.04.31.13.1-2ubuntu0.16.04.41.13.1-2ubuntu0.16.04.4+esm11.13.1-2ubuntu0.16.04.4+esm21.13.1-2ubuntu0.16.04.4+esm31.13.1-2ubuntu0.16.04.4+esm4
 None known
python-pip
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.5.6-7ubuntu11.5.6-7ubuntu28.0.2-78.0.3-18.0.3-2
Show 17 moreShow less
8.1.0-18.1.0-28.1.1-18.1.1-28.1.1-2ubuntu0.18.1.1-2ubuntu0.28.1.1-2ubuntu0.48.1.1-2ubuntu0.68.1.1-2ubuntu0.6+esm28.1.1-2ubuntu0.6+esm38.1.1-2ubuntu0.6+esm48.1.1-2ubuntu0.6+esm58.1.1-2ubuntu0.6+esm68.1.1-2ubuntu0.6+esm88.1.1-2ubuntu0.6+esm108.1.1-2ubuntu0.6+esm118.1.1-2ubuntu0.6+esm12
 None known
python-urllib3
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.21.1-11.22-11.22-1ubuntu0.18.04.11.22-1ubuntu0.18.04.21.22-1ubuntu0.18.04.2+esm1
Show 4 moreShow less
1.22-1ubuntu0.18.04.2+esm21.22-1ubuntu0.18.04.2+esm31.22-1ubuntu0.18.04.2+esm41.22-1ubuntu0.18.04.2+esm5
 None known
python-pip
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
9.0.1-29.0.1-2.3~ubuntu19.0.1-2.3~ubuntu1.18.04.19.0.1-2.3~ubuntu1.18.04.29.0.1-2.3~ubuntu1.18.04.3
Show 15 moreShow less
9.0.1-2.3~ubuntu1.18.04.49.0.1-2.3~ubuntu1.18.04.59.0.1-2.3~ubuntu1.18.04.5+esm29.0.1-2.3~ubuntu1.18.04.5+esm39.0.1-2.3~ubuntu1.18.04.69.0.1-2.3~ubuntu1.18.04.6+esm19.0.1-2.3~ubuntu1.18.04.79.0.1-2.3~ubuntu1.18.04.7+esm19.0.1-2.3~ubuntu1.18.04.89.0.1-2.3~ubuntu1.18.04.8+esm19.0.1-2.3~ubuntu1.18.04.8+esm29.0.1-2.3~ubuntu1.18.04.8+esm49.0.1-2.3~ubuntu1.18.04.8+esm69.0.1-2.3~ubuntu1.18.04.8+esm79.0.1-2.3~ubuntu1.18.04.8+esm8
 None known
python-urllib3
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.24.1-1ubuntu11.24.1-1ubuntu21.25.8-11.25.8-21.25.8-2ubuntu0.1
Show 9 moreShow less
1.25.8-2ubuntu0.21.25.8-2ubuntu0.31.25.8-2ubuntu0.41.25.8-2ubuntu0.4+esm11.25.8-2ubuntu0.4+esm21.25.8-2ubuntu0.4+esm31.25.8-2ubuntu0.4+esm41.25.8-2ubuntu0.4+esm51.25.8-2ubuntu0.4+esm6
 None known
python-pip
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
18.1-518.1-5build118.1-5ubuntu120.0.2-220.0.2-4
Show 16 moreShow less
20.0.2-520.0.2-5ubuntu120.0.2-5ubuntu1.120.0.2-5ubuntu1.320.0.2-5ubuntu1.420.0.2-5ubuntu1.520.0.2-5ubuntu1.620.0.2-5ubuntu1.720.0.2-5ubuntu1.820.0.2-5ubuntu1.920.0.2-5ubuntu1.1020.0.2-5ubuntu1.10+esm220.0.2-5ubuntu1.1120.0.2-5ubuntu1.11+esm220.0.2-5ubuntu1.11+esm320.0.2-5ubuntu1.11+esm4
 None known
python-urllib3
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.26.5-1~exp11.26.5-1~exp1ubuntu0.11.26.5-1~exp1ubuntu0.21.26.5-1~exp1ubuntu0.31.26.5-1~exp1ubuntu0.4
Show 4 moreShow less
1.26.5-1~exp1ubuntu0.51.26.5-1~exp1ubuntu0.61.26.5-1~exp1ubuntu0.71.26.5-1~exp1ubuntu0.8
 None known
python-pip
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
20.3.4-421.3.1+dfsg-322.0.2+dfsg-122.0.2+dfsg-1ubuntu0.122.0.2+dfsg-1ubuntu0.2
Show 8 moreShow less
22.0.2+dfsg-1ubuntu0.322.0.2+dfsg-1ubuntu0.422.0.2+dfsg-1ubuntu0.522.0.2+dfsg-1ubuntu0.622.0.2+dfsg-1ubuntu0.722.0.2+dfsg-1ubuntu0.7+esm122.0.2+dfsg-1ubuntu0.7+esm222.0.2+dfsg-1ubuntu0.7+esm3
 None known
python-urllib3
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.26.16-11.26.18-12.0.7-12.0.7-1ubuntu0.12.0.7-1ubuntu0.2
Show 6 moreShow less
2.0.7-1ubuntu0.32.0.7-1ubuntu0.42.0.7-1ubuntu0.52.0.7-1ubuntu0.62.0.7-1ubuntu0.72.0.7-1ubuntu0.8
 None known
python-pip
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
23.2+dfsg-123.3+dfsg-124.0+dfsg-124.0+dfsg-1ubuntu124.0+dfsg-1ubuntu1.1
Show 5 moreShow less
24.0+dfsg-1ubuntu1.224.0+dfsg-1ubuntu1.324.0+dfsg-1ubuntu1.3+esm124.0+dfsg-1ubuntu1.3+esm224.0+dfsg-1ubuntu1.3+esm3
 None known
python-pip
Ubuntu:25.10
 All versions, plus listed versions
25.0+dfsg-125.1.1+dfsg-125.1.1+dfsg-1ubuntu125.1.1+dfsg-1ubuntu2
 None known
python-urllib3
Ubuntu:25.10
 All versions, plus listed versions
2.3.0-22.3.0-2ubuntu12.3.0-32.3.0-3ubuntu0.12.3.0-3ubuntu0.22.3.0-3ubuntu0.32.3.0-3ubuntu0.42.3.0-3ubuntu0.6
 None known
python-urllib3
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.3.0-32.5.0-12.5.0-1ubuntu12.5.0-1ubuntu22.6.3-1ubuntu12.6.3-1ubuntu1.12.6.3-1ubuntu1.2
 None known
python-pip
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
25.1.1+dfsg-1ubuntu225.1.1+dfsg-1ubuntu2+esm125.1.1+dfsg-1ubuntu2+esm225.1.1+dfsg-1ubuntu2+esm3
 None known
python-urllib3
openSUSE:Leap 16.0
 before 2.5.0-160000.7.1
2.5.0-160000.7.1

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-9375 has been rejected by its source and should not be treated as a live vulnerability, published June 19, 2026. Fixed in py3-urllib3 2.7.0-r0.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open