Overview
This article discusses CVE-2025-66471, a vulnerability affecting urllib3, a popular user-friendly HTTP client library for Python. Specifically, the vulnerability resides in the streaming API and its handling of highly compressed data. This can lead to excessive resource consumption, potentially causing denial-of-service conditions.
Technical Details
Urllib3’s streaming API is designed to efficiently handle large HTTP responses by processing data in chunks. When dealing with compressed responses (e.g., gzip, deflate, br, or zstd), urllib3 decompresses the data based on the Content-Encoding header.
The vulnerability arises because the decompression logic can, in certain scenarios with highly compressed data, fully decode a small amount of data in a single operation, even if only a small chunk was requested. The excess decompressed data is then stored in an internal buffer. This can lead to excessive CPU usage and massive memory allocation for the decompressed data, especially when an attacker can control the content being served and its compression.
Affected versions are urllib3 versions 1.0 and prior to 2.6.0.
CVSS Analysis
Currently, there is no CVSS score assigned to CVE-2025-66471. This does not diminish the importance of the vulnerability. The lack of a CVSS score might be due to the recent publication of the vulnerability. A CVSS score will likely be assigned in the future.
Possible Impact
The exploitation of CVE-2025-66471 can lead to several negative consequences:
- Denial of Service (DoS): Excessive CPU and memory consumption can overwhelm the server, making it unresponsive to legitimate requests.
- Resource Exhaustion: Continued exploitation can lead to complete resource exhaustion, potentially crashing the application.
- Application Instability: Uncontrolled memory allocation can lead to unpredictable application behavior and instability.
Mitigation or Patch Steps
The recommended solution is to upgrade to urllib3 version 2.6.0 or later. This version contains a fix that addresses the improper handling of highly compressed data in the streaming API.
To upgrade urllib3, use pip:
pip install --upgrade urllib3Verify the installed version:
python -c "import urllib3; print(urllib3.__version__)"
