What’s Vulnerable › Vulnerabilities

CVE-2025-66418: urllib3 allows an unbounded number of links in the decompression chain

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-05 · updated 2026-09-25
• Weakness: CWE-770

Description

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

Affected products

• urllib3: from 1.24 before 2.6.0 — fixed in 2.6.0
• Pypi Urllib3: from 1.24 before 2.6.0; 1.24, 1.24.1, 1.24.2, 1.24.3, 1.25, 1.25.1 (+51) — fixed in 2.6.0

How to fix

Upgrade to a fixed version: urllib3 2.6.0; Pypi Urllib3 2.6.0. Check the vendor advisory for mitigations.

References

• https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8
• https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53

Get alerted when CVE-2025-66418 or the next vulnerability affects your stack