urllib3-2.6.0 (Python Module)

[Douglas R. Reno]

New minor version that fixes two security issues.

2.6.0 (2025-12-05)
Security

Fixed a security issue where streaming API could improperly handle 
highly compressed HTTP content ("decompression bombs") leading to 
excessive resource consumption even when a small amount of data was 
requested. Reading small chunks of compressed data is safer and much 
more efficient now. (GHSA-2xpw-w6gg-jr37)

Fixed a security issue where an attacker could compose an HTTP 
response with virtually unlimited links in the Content-Encoding header, 
potentially leading to a denial of service (DoS) attack by exhausting 
system resources during decoding. The number of allowed chained 
encodings is now limited to 5. (GHSA-gm62-xv2j-4w53)

Caution!

If urllib3 is not installed with the optional urllib3[brotli] extra, 
but your environment contains a Brotli/brotlicffi/brotlipy package 
anyway, make sure to upgrade it to at least Brotli 1.2.0 or brotlicffi 
1.2.0.0 to benefit from the security fixes and avoid warnings. Prefer 
using urllib3[brotli] to install a compatible Brotli package 
automatically.

If you use custom decompressors, please make sure to update them to 
respect the changed API of urllib3.response.ContentDecoder.

Features

Enabled retrieval, deletion, and membership testing in HTTPHeaderDict 
using bytes keys. (#3653)
Added host and port information to string representations of 
HTTPConnection. (#3666)
Added support for Python 3.14 free-threading builds explicitly. (#3696)

Removals

Removed the HTTPResponse.getheaders() method in favor of 
HTTPResponse.headers. Removed the HTTPResponse.getheader(name, default)
method in favor of HTTPResponse.headers.get(name, default). (#3622)

Bugfixes

Fixed redirect handling in urllib3.PoolManager when an integer is passed for the retries parameter. (#3649)
Fixed HTTPConnectionPool when used in Emscripten with no explicit port. 
(#3664)
Fixed handling of SSLKEYLOGFILE with expandable variables. (#3700)

Misc

Changed the zstd extra to install backports.zstd instead of zstandard on 
Python 3.13 and before. (#3693)
Improved the performance of content decoding by optimizing 
BytesQueueBuffer class. (#3710)
Allowed building the urllib3 package with newer setuptools-scm v9.x. 
(#3652)
Ensured successful urllib3 builds by setting Hatchling requirement to >= 
1.27.0. (#3638)

I caught this from oss-security.

CVE-2025-66418

Unbounded number of links in the decompression chain
====================================================

illia-v published GHSA-gm62-xv2j-4w53 Dec 5, 2025

Package: urllib3 (pip)
Affected versions: >=1.24,<2.6.0
Patched versions: 2.6.0

Description
===========

Impact
------

urllib3 supports chained HTTP encoding algorithms for response content
according to RFC 9110 (e.g., Content-Encoding: gzip, zstd).

However, the number of links in the decompression chain was unbounded
allowing a malicious server to insert a virtually unlimited number of
compression steps leading to high CPU usage and massive memory
allocation for the decompressed data.

Affected usages
---------------

Applications and libraries using urllib3 version 2.5.0 and earlier for
HTTP requests to untrusted sources unless they disable content
decoding explicitly.

Remediation
-----------

Upgrade to at least urllib3 v2.6.0 in which the library limits the
number of links to 5.

If upgrading is not immediately possible, use preload_content=False
and ensure that resp.headers["content-encoding"] contains a safe
number of encodings before reading the response content.

Severity:  High  8.9 / 10
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
CVE ID: CVE-2025-66418
Weaknesses: Weakness CWE-770 

CVE-2025-66471

Streaming API improperly handles highly compressed data
=======================================================

illia-v published GHSA-2xpw-w6gg-jr37 Dec 5, 2025

Package: urllib3 (pip)
Affected versions: >=1.0,<2.6.0
Patched versions: 2.6.0

Description
===========

Impact
------

urllib3's streaming API is designed for the efficient handling of
large HTTP responses by reading the content in chunks, rather than
loading the entire response body into memory at once.

When streaming a compressed response, urllib3 can perform decoding or
decompression based on the HTTP Content-Encoding header (e.g., gzip,
deflate, br, or zstd). The library must read compressed data from the
network and decompress it until the requested chunk size is met. Any
resulting decompressed data that exceeds the requested amount is held
in an internal buffer for the next read operation.

The decompression logic could cause urllib3 to fully decode a small
amount of highly compressed data in a single operation. This can
result in excessive resource consumption (high CPU usage and massive
memory allocation for the decompressed data; CWE-409) on the client
side, even if the application only requested a small chunk of data.

Affected usages
---------------

Applications and libraries using urllib3 version 2.5.0 and earlier to
stream large compressed responses or content from untrusted sources.

stream(), read(amt=256), read1(amt=256), read_chunked(amt=256),
readinto(b) are examples of urllib3.HTTPResponse method calls using
the affected logic unless decoding is disabled explicitly.

Remediation
-----------

Upgrade to at least urllib3 v2.6.0 in which the library avoids
decompressing data that exceeds the requested amount.

If your environment contains a package facilitating the Brotli
encoding, upgrade to at least Brotli 1.2.0 or brotlicffi 1.2.0.0
too. These versions are enforced by the urllib3[brotli] extra in the
patched versions of urllib3.

Credits
-------

The issue was reported by @Cycloctane.

Supplemental information was provided by @stamparm during a security
audit performed by 7ASecurity and facilitated by OSTIF.

Severity: High 8.9 / 10
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
CVE ID: CVE-2025-66471
Weaknesses: Weakness CWE-409 

[Bruce Dubbs]

Fixed at commit 117bfa5ffd.

Leaving open and reassigning for security advisory.

[Douglas R. Reno]

SA-12.4-053 issued

[Bruce Dubbs]

Milestone renamed