Vulnerability-Lookup

BDU:2026-03452 (CVE-2025-66471)

Vulnerability from fstec – Published: 2026-03-23 – Updated: 2026-04-20 – View on bdu.fstec.ru Fixed

Title

Уязвимость HTTP библиотеки Urllib3 языка программирования Python, связанная с некорректной обработкой сильно сжатых входных данных, позволяющая нарушителю вызвать отказ в обслуживании

Summary

Уязвимость HTTP библиотеки Urllib3 языка программирования Python связана с некорректной обработкой сильно сжатых входных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании

Severity

7.8 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:N/I:N/A:C

8.6 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Resource manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-409 - Неправильная обработка сильно сжатых данных (Усиление данных)

Aliases

CVE-2025-66471, GHSA-2XPW-W6GG-JR37

References

7 references

URL
https://github.com/urllib3/urllib3
https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7
http://repo.red-soft.ru/redos/8.0/x86_64/updates/
https://access.redhat.com/security/cve/cve-2025-66471
https://ubuntu.com/security/CVE-2025-66471
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2025-66471
https://altsp.su/obnovleniya-bezopasnosti/

Impacted products

49 products from 8 vendors

Vendors

Red Hat, Inc., АО «ИВК», Canonical Ltd., Fedora Project, ООО «Ред Софт», АО «СберТех», Andrey Petrov

Products

Red Hat Enterprise Linux, OpenShift Container Platform, Red Hat Openshift Data Foundation, Red Hat Satellite, Migration Toolkit for Virtualization, OpenShift Serverless, Red Hat Ansible Automation Platform, OpenShift Dev Spaces, Red Hat OpenStack Platform, Migration Toolkit for Containers, OpenShift Pipelines, Red Hat Ceph Storage, АЛЬТ СП 10, Logging subsystem for Red Hat OpenShift, Red Hat Developer Hub, multicluster engine for Kubernetes, Ubuntu, OpenShift AI, Red Hat OpenShift Lightspeed, Fedora, Red Hat AI Inference Server, Builds for Red Hat OpenShift, Confidential Compute Attestation, Multiarch Tuning Operator, Fedora EPEL, Red Hat OpenShift GitOps, РЕД ОС (запись в едином реестре российских программ №3751), Platform V SberLinux OS Server (запись в едином реестре российских программ №18785), RHUI, cert-manager Operator for Red Hat OpenShift, OpenShift API for Data Protection, Multicluster Global Hub, Red Hat Quay, Red Hat Trusted Artifact Signer, Mirror registry for Red Hat OpenShift, Red Hat build of Quarkus Native builder, Red Hat Certification Program for Red Hat Enterprise Linux, Red Hat Connectivity Link, Red Hat Edge Manager preview, Red Hat Enterprise Linux AI, Red Hat Offline Knowledge Portal, Discovery, Network Observability, Red Hat Advanced Cluster Management for Kubernetes, Red Hat Update Infrastructure, External Secrets Operator for Red Hat OpenShift, Fence Agents Remediation Operator, Red Hat Ansible Automation Platform Ansible Core, urllib3

Versions

6 (Red Hat Enterprise Linux), 7 (Red Hat Enterprise Linux), 8 (Red Hat Enterprise Linux), 4 (OpenShift Container Platform), 4 (Red Hat Openshift Data Foundation), 6 (Red Hat Satellite), 9 (Red Hat Enterprise Linux), 8.2 Advanced Update Support (Red Hat Enterprise Linux), - (Migration Toolkit for Virtualization), - (OpenShift Serverless), 2 (Red Hat Ansible Automation Platform), 8.4 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), - (OpenShift Dev Spaces), 17.1 (Red Hat OpenStack Platform), - (Migration Toolkit for Containers), - (OpenShift Pipelines), 6 (Red Hat Ceph Storage), - (АЛЬТ СП 10), 2.4 (Red Hat Ansible Automation Platform), - (Logging subsystem for Red Hat OpenShift), - (Red Hat Developer Hub), - (multicluster engine for Kubernetes), 24.04 LTS (Ubuntu), 7 (Red Hat Ceph Storage), 9.0 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.6 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.6 Telecommunications Update Service (Red Hat Enterprise Linux), 8.6 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), 7 Extended Lifecycle Support (Red Hat Enterprise Linux), - (OpenShift AI), 6.16 for RHEL 8 (Red Hat Satellite), 6.16 for RHEL 9 (Red Hat Satellite), 9.4 Extended Update Support (Red Hat Enterprise Linux), 2.4 for RHEL 8 (Red Hat Ansible Automation Platform), 2.4 for RHEL 9 (Red Hat Ansible Automation Platform), 8 (Red Hat Ceph Storage), - (Red Hat OpenShift Lightspeed), 2.5 for RHEL 8 (Red Hat Ansible Automation Platform), 2.5 for RHEL 9 (Red Hat Ansible Automation Platform), 42 (Fedora), 10 (Red Hat Enterprise Linux), 8.8 Telecommunications Update Service (Red Hat Enterprise Linux), 8.8 Update Services for SAP Solutions (Red Hat Enterprise Linux), 9.2 Update Services for SAP Solutions (Red Hat Enterprise Linux), - (Red Hat AI Inference Server), - (Builds for Red Hat OpenShift), - (Confidential Compute Attestation), - (Multiarch Tuning Operator), epel9 (Fedora EPEL), 8.4 Extended Update Support Long-Life Add-On (Red Hat Enterprise Linux), epel10 (Fedora EPEL), 43 (Fedora), 1.17 (Red Hat OpenShift GitOps), 25.10 (Ubuntu), 9.6 Extended Update Support (Red Hat Enterprise Linux), 8.0 (РЕД ОС), 9 (Red Hat Ceph Storage), 10.0 Extended Update Support (Red Hat Enterprise Linux), 9.2.0-fstec (Platform V SberLinux OS Server), 6.17 for RHEL 9 (Red Hat Satellite), 4 for RHEL 8 (RHUI), 1.18 (cert-manager Operator for Red Hat OpenShift), 1.3 (OpenShift API for Data Protection), 3.2 (Red Hat AI Inference Server), 1.4.4 (Multicluster Global Hub), 1.5.3 (Multicluster Global Hub), 2.25 (OpenShift AI), 3.26 (OpenShift Dev Spaces), 1.18 (Red Hat OpenShift GitOps), 3.1 (Red Hat Quay), 3.12 (Red Hat Quay), 3.13 (Red Hat Quay), 3.15 (Red Hat Quay), 3.16 (Red Hat Quay), 6.18 (Red Hat Satellite), 1.2 (Red Hat Trusted Artifact Signer), 1.3 (Red Hat Trusted Artifact Signer), 2 (Mirror registry for Red Hat OpenShift), - (Red Hat build of Quarkus Native builder), 9 (Red Hat Certification Program for Red Hat Enterprise Linux), 1 (Red Hat Connectivity Link), - (Red Hat Edge Manager preview), 3 (Red Hat Enterprise Linux AI), - (Red Hat Offline Knowledge Portal), 2.6 for RHEL 9 (Red Hat Ansible Automation Platform), 2.5 (Red Hat Ansible Automation Platform), 2 (Discovery), 6.18 for RHEL 9 (Red Hat Satellite), 1.11.0 (Network Observability), 4.8 (Red Hat Advanced Cluster Management for Kubernetes), 4.9 (Red Hat Advanced Cluster Management for Kubernetes), 2.6 (Red Hat Ansible Automation Platform), 3.3 (OpenShift AI), 5 (Red Hat Update Infrastructure), - (External Secrets Operator for Red Hat OpenShift), - (Fence Agents Remediation Operator), 2 (Red Hat Ansible Automation Platform Ansible Core), от 1.0 до 2.6.0 (urllib3), до 9.2.0-fstec (Platform V SberLinux OS Server)

Product types

Operating system, Application software, Virtualization software, Network software, Appliance software, Network device, AI development software

Platforms

Red Hat, Inc. Red Hat Enterprise Linux 6, Inc. Red Hat Enterprise Linux 7, Inc. Red Hat Enterprise Linux 8, Inc. Red Hat Enterprise Linux 9, Inc. Red Hat Enterprise Linux 8.2 Advanced Update Support, Inc. Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, АО «ИВК» АЛЬТ СП 10 -, Canonical Ltd. Ubuntu 24.04 LTS, Inc. Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Inc. Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Inc. Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Inc. Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Inc. Red Hat Enterprise Linux 7 Extended Lifecycle Support, Inc. Red Hat Enterprise Linux 9.4 Extended Update Support, Fedora Project Fedora 42, Inc. Red Hat Enterprise Linux 10, Inc. Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Inc. Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Inc. Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Inc. Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Fedora Project Fedora 43, Canonical Ltd. Ubuntu 25.10, Inc. Red Hat Enterprise Linux 9.6 Extended Update Support, ООО «Ред Софт» РЕД ОС 8.0 (запись в едином реестре российских программ №3751), Inc. Red Hat Enterprise Linux 10.0 Extended Update Support, АО «СберТех» Platform V SberLinux OS Server 9.2.0-fstec (запись в едином реестре российских программ №18785), Inc. Red Hat Enterprise Linux AI 3, АО «СберТех» Platform V SberLinux OS Server до 9.2.0-fstec (запись в едином реестре российских программ №18785)

Mitigations

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года. Использование рекомендаций: Для Urllib3: https://github.com/urllib3/urllib3 https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7 Для Ред ОС: http://repo.red-soft.ru/redos/8.0/x86_64/updates/ Для программных продуктов Red Hat Inc.: https://access.redhat.com/security/cve/cve-2025-66471 Для Ubuntu: https://ubuntu.com/security/CVE-2025-66471 Для Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2025-66471 Для ОС АЛЬТ СП 10: установка обновления из публичного репозитория программного средства: https://altsp.su/obnovleniya-bezopasnosti/ Для Platform V SberLinux OS Server: Обновление операционной системы до версии 9.2.2-fstec Для Platform V SberLinux OS Server: Обновление операционной системы до версии 9.2.2-fstec или выше

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Red Hat, Inc., \u0410\u041e \u00ab\u0418\u0412\u041a\u00bb, Canonical Ltd., Fedora Project, \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb, \u0410\u041e \u00ab\u0421\u0431\u0435\u0440\u0422\u0435\u0445\u00bb, Andrey Petrov",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "6 (Red Hat Enterprise Linux), 7 (Red Hat Enterprise Linux), 8 (Red Hat Enterprise Linux), 4 (OpenShift Container Platform), 4 (Red Hat Openshift Data Foundation), 6 (Red Hat Satellite), 9 (Red Hat Enterprise Linux), 8.2 Advanced Update Support (Red Hat Enterprise Linux), - (Migration Toolkit for Virtualization), - (OpenShift Serverless), 2 (Red Hat Ansible Automation Platform), 8.4 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), - (OpenShift Dev Spaces), 17.1 (Red Hat OpenStack Platform), - (Migration Toolkit for Containers), - (OpenShift Pipelines), 6 (Red Hat Ceph Storage), - (\u0410\u041b\u042c\u0422 \u0421\u041f 10), 2.4 (Red Hat Ansible Automation Platform), - (Logging subsystem for Red Hat OpenShift), - (Red Hat Developer Hub), - (multicluster engine for Kubernetes), 24.04 LTS (Ubuntu), 7 (Red Hat Ceph Storage), 9.0 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.6 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.6 Telecommunications Update Service (Red Hat Enterprise Linux), 8.6 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), 7 Extended Lifecycle Support (Red Hat Enterprise Linux), - (OpenShift AI), 6.16 for RHEL 8 (Red Hat Satellite), 6.16 for RHEL 9 (Red Hat Satellite), 9.4 Extended Update Support (Red Hat Enterprise Linux), 2.4 for RHEL 8 (Red Hat Ansible Automation Platform), 2.4 for RHEL 9 (Red Hat Ansible Automation Platform), 8 (Red Hat Ceph Storage), - (Red Hat OpenShift Lightspeed), 2.5 for RHEL 8 (Red Hat Ansible Automation Platform), 2.5 for RHEL 9 (Red Hat Ansible Automation Platform), 42 (Fedora), 10 (Red Hat Enterprise Linux), 8.8 Telecommunications Update Service (Red Hat Enterprise Linux), 8.8 Update Services for SAP Solutions (Red Hat Enterprise Linux), 9.2 Update Services for SAP Solutions (Red Hat Enterprise Linux), - (Red Hat AI Inference Server), - (Builds for Red Hat OpenShift), - (Confidential Compute Attestation), - (Multiarch Tuning Operator), epel9 (Fedora EPEL), 8.4 Extended Update Support Long-Life Add-On (Red Hat Enterprise Linux), epel10 (Fedora EPEL), 43 (Fedora), 1.17 (Red Hat OpenShift GitOps), 25.10 (Ubuntu), 9.6 Extended Update Support (Red Hat Enterprise Linux), 8.0 (\u0420\u0415\u0414 \u041e\u0421), 9 (Red Hat Ceph Storage), 10.0 Extended Update Support (Red Hat Enterprise Linux), 9.2.0-fstec (Platform V SberLinux OS Server), 6.17 for RHEL 9 (Red Hat Satellite), 4 for RHEL 8 (RHUI), 1.18 (cert-manager Operator for Red Hat OpenShift), 1.3 (OpenShift API for Data Protection), 3.2 (Red Hat AI Inference Server), 1.4.4 (Multicluster Global Hub), 1.5.3 (Multicluster Global Hub), 2.25 (OpenShift AI), 3.26 (OpenShift Dev Spaces), 1.18 (Red Hat OpenShift GitOps), 3.1 (Red Hat Quay), 3.12 (Red Hat Quay), 3.13 (Red Hat Quay), 3.15 (Red Hat Quay), 3.16 (Red Hat Quay), 6.18 (Red Hat Satellite), 1.2 (Red Hat Trusted Artifact Signer), 1.3 (Red Hat Trusted Artifact Signer), 2 (Mirror registry for Red Hat OpenShift), - (Red Hat build of Quarkus Native builder), 9 (Red Hat Certification Program for Red Hat Enterprise Linux), 1 (Red Hat Connectivity Link), - (Red Hat Edge Manager preview), 3 (Red Hat Enterprise Linux AI), - (Red Hat Offline Knowledge Portal), 2.6 for RHEL 9 (Red Hat Ansible Automation Platform), 2.5 (Red Hat Ansible Automation Platform), 2 (Discovery), 6.18 for RHEL 9 (Red Hat Satellite), 1.11.0 (Network Observability), 4.8 (Red Hat Advanced Cluster Management for Kubernetes), 4.9 (Red Hat Advanced Cluster Management for Kubernetes), 2.6 (Red Hat Ansible Automation Platform), 3.3 (OpenShift AI), 5 (Red Hat Update Infrastructure), - (External Secrets Operator for Red Hat OpenShift), - (Fence Agents Remediation Operator), 2 (Red Hat Ansible Automation Platform Ansible Core), \u043e\u0442 1.0 \u0434\u043e 2.6.0 (urllib3), \u0434\u043e 9.2.0-fstec (Platform V SberLinux OS Server)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439: \n\n\u0414\u043b\u044f Urllib3:\nhttps://github.com/urllib3/urllib3\nhttps://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7\n\n\u0414\u043b\u044f \u0420\u0435\u0434 \u041e\u0421: \nhttp://repo.red-soft.ru/redos/8.0/x86_64/updates/\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/cve-2025-66471\n\n\u0414\u043b\u044f Ubuntu:\nhttps://ubuntu.com/security/CVE-2025-66471\n\n\u0414\u043b\u044f Fedora:\nhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2025-66471\n\n\u0414\u043b\u044f \u041e\u0421 \u0410\u041b\u042c\u0422 \u0421\u041f 10: \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0437 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430: https://altsp.su/obnovleniya-bezopasnosti/\n\n\u0414\u043b\u044f Platform V SberLinux OS Server:\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 9.2.2-fstec\n\n\u0414\u043b\u044f Platform V SberLinux OS Server:\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 9.2.2-fstec \u0438\u043b\u0438 \u0432\u044b\u0448\u0435",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "05.12.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "20.04.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "23.03.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-03452",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-66471, GHSA-2xpw-w6gg-jr37",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Red Hat Enterprise Linux, OpenShift Container Platform, Red Hat Openshift Data Foundation, Red Hat Satellite, Migration Toolkit for Virtualization, OpenShift Serverless, Red Hat Ansible Automation Platform, OpenShift Dev Spaces, Red Hat OpenStack Platform, Migration Toolkit for Containers, OpenShift Pipelines, Red Hat Ceph Storage, \u0410\u041b\u042c\u0422 \u0421\u041f 10, Logging subsystem for Red Hat OpenShift, Red Hat Developer Hub, multicluster engine for Kubernetes, Ubuntu, OpenShift AI, Red Hat OpenShift Lightspeed, Fedora, Red Hat AI Inference Server, Builds for Red Hat OpenShift, Confidential Compute Attestation, Multiarch Tuning Operator, Fedora EPEL, Red Hat OpenShift GitOps, \u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Platform V SberLinux OS Server (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u211618785), RHUI, cert-manager Operator for Red Hat OpenShift, OpenShift API for Data Protection, Multicluster Global Hub, Red Hat Quay, Red Hat Trusted Artifact Signer, Mirror registry for Red Hat OpenShift, Red Hat build of Quarkus Native builder, Red Hat Certification Program for Red Hat Enterprise Linux, Red Hat Connectivity Link, Red Hat Edge Manager preview, Red Hat Enterprise Linux AI, Red Hat Offline Knowledge Portal, Discovery, Network Observability, Red Hat Advanced Cluster Management for Kubernetes, Red Hat Update Infrastructure, External Secrets Operator for Red Hat OpenShift, Fence Agents Remediation Operator, Red Hat Ansible Automation Platform Ansible Core, urllib3",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Red Hat, Inc. Red Hat Enterprise Linux 6 , Red Hat, Inc. Red Hat Enterprise Linux 7 , Red Hat, Inc. Red Hat Enterprise Linux 8 , Red Hat, Inc. Red Hat Enterprise Linux 9 , Red Hat, Inc. Red Hat Enterprise Linux 8.2 Advanced Update Support , Red Hat, Inc. Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support , \u0410\u041e \u00ab\u0418\u0412\u041a\u00bb \u0410\u041b\u042c\u0422 \u0421\u041f 10 - , Canonical Ltd. Ubuntu 24.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions , Red Hat, Inc. Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions , Red Hat, Inc. Red Hat Enterprise Linux 8.6 Telecommunications Update Service , Red Hat, Inc. Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support , Red Hat, Inc. Red Hat Enterprise Linux 7 Extended Lifecycle Support , Red Hat, Inc. Red Hat Enterprise Linux 9.4 Extended Update Support , Fedora Project Fedora 42 , Red Hat, Inc. Red Hat Enterprise Linux 10 , Red Hat, Inc. Red Hat Enterprise Linux 8.8 Telecommunications Update Service , Red Hat, Inc. Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions , Red Hat, Inc. Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions , Red Hat, Inc. Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On , Fedora Project Fedora 43 , Canonical Ltd. Ubuntu 25.10 , Red Hat, Inc. Red Hat Enterprise Linux 9.6 Extended Update Support , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 8.0  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Red Hat, Inc. Red Hat Enterprise Linux 10.0 Extended Update Support , \u0410\u041e \u00ab\u0421\u0431\u0435\u0440\u0422\u0435\u0445\u00bb Platform V SberLinux OS Server 9.2.0-fstec  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u211618785), Red Hat, Inc. Red Hat Enterprise Linux AI 3 , \u0410\u041e \u00ab\u0421\u0431\u0435\u0440\u0422\u0435\u0445\u00bb Platform V SberLinux OS Server \u0434\u043e 9.2.0-fstec  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u211618785)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c HTTP \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 Urllib3 \u044f\u0437\u044b\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Python, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0441\u0438\u043b\u044c\u043d\u043e \u0441\u0436\u0430\u0442\u044b\u0445 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u0441\u0438\u043b\u044c\u043d\u043e \u0441\u0436\u0430\u0442\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (\u0423\u0441\u0438\u043b\u0435\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445) (CWE-409)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c HTTP \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 Urllib3 \u044f\u0437\u044b\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Python \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0441\u0438\u043b\u044c\u043d\u043e \u0441\u0436\u0430\u0442\u044b\u0445 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://github.com/urllib3/urllib3\nhttps://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7\nhttp://repo.red-soft.ru/redos/8.0/x86_64/updates/\nhttps://access.redhat.com/security/cve/cve-2025-66471\nhttps://ubuntu.com/security/CVE-2025-66471\nhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2025-66471\nhttps://altsp.su/obnovleniya-bezopasnosti/\n\n",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u041f\u041e \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438/\u041f\u041e \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u041f\u041e \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0418\u0418",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-409",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,6)"
}

CVE-2025-66471 (GCVE-0-2025-66471)

Vulnerability from cvelistv5 – Published: 2025-12-05 16:06 – Updated: 2025-12-05 19:33

Title

urllib3 Streaming API improperly handles highly compressed data

Summary

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.

Severity

8.9 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-05 19:32 UTC

CWE

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/urllib3/urllib3/security/advis…	x_refsource_CONFIRM
https://github.com/urllib3/urllib3/commit/c19571d…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
urllib3	urllib3	Affected: >= 1.0, < 2.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-66471",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-05T19:32:57.089218Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-05T19:33:14.832Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "urllib3",
          "vendor": "urllib3",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0, \u003c 2.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3\u0027s streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-409",
              "description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-05T16:06:08.531Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37"
        },
        {
          "name": "https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7"
        }
      ],
      "source": {
        "advisory": "GHSA-2xpw-w6gg-jr37",
        "discovery": "UNKNOWN"
      },
      "title": "urllib3 Streaming API improperly handles highly compressed data"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-66471",
    "datePublished": "2025-12-05T16:06:08.531Z",
    "dateReserved": "2025-12-02T15:43:16.586Z",
    "dateUpdated": "2025-12-05T19:33:14.832Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-2XPW-W6GG-JR37

Vulnerability from github – Published: 2025-12-05 18:15 – Updated: 2025-12-05 18:33

Summary

urllib3 streaming API improperly handles highly compressed data

Details

Impact

urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.

When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation.

The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.

Affected usages

Applications and libraries using urllib3 version 2.5.0 and earlier to stream large compressed responses or content from untrusted sources.

stream(), read(amt=256), read1(amt=256), read_chunked(amt=256), readinto(b) are examples of urllib3.HTTPResponse method calls using the affected logic unless decoding is disabled explicitly.

Remediation

Upgrade to at least urllib3 v2.6.0 in which the library avoids decompressing data that exceeds the requested amount.

If your environment contains a package facilitating the Brotli encoding, upgrade to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 too. These versions are enforced by the urllib3[brotli] extra in the patched versions of urllib3.

Credits

The issue was reported by @Cycloctane. Supplemental information was provided by @stamparm during a security audit performed by 7ASecurity and facilitated by OSTIF.

Severity

8.9 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "urllib3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0"
            },
            {
              "fixed": "2.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-66471"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-409"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-05T18:15:54Z",
    "nvd_published_at": "2025-12-05T17:16:04Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nurllib3\u0027s [streaming API](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.\n\nWhen streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation.\n\nThe decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.\n\n\n### Affected usages\n\nApplications and libraries using urllib3 version 2.5.0 and earlier to stream large compressed responses or content from untrusted sources.\n\n`stream()`, `read(amt=256)`, `read1(amt=256)`, `read_chunked(amt=256)`, `readinto(b)` are examples of `urllib3.HTTPResponse` method calls using the affected logic unless decoding is disabled explicitly.\n\n\n### Remediation\n\nUpgrade to at least urllib3 v2.6.0 in which the library avoids decompressing data that exceeds the requested amount.\n\nIf your environment contains a package facilitating the Brotli encoding, upgrade to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 too. These versions are enforced by the `urllib3[brotli]` extra in the patched versions of urllib3.\n\n\n### Credits\n\nThe issue was reported by @Cycloctane.\nSupplemental information was provided by @stamparm during a security audit performed by [7ASecurity](https://7asecurity.com/) and facilitated by [OSTIF](https://ostif.org/).",
  "id": "GHSA-2xpw-w6gg-jr37",
  "modified": "2025-12-05T18:33:07Z",
  "published": "2025-12-05T18:15:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66471"
    },
    {
      "type": "WEB",
      "url": "https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/urllib3/urllib3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "urllib3 streaming API improperly handles highly compressed data"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2026-03452 (CVE-2025-66471)

CVE-2025-66471 (GCVE-0-2025-66471)

GHSA-2XPW-W6GG-JR37

Impact

Affected usages

Remediation

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour