Loading story…
Two critical vulnerabilities have been identified in the Python HTTP client library urllib3, affecting versions from 1.0 up to but not including 2.6.0. The first vulnerability (CVE-2025-66471) involves the Streaming API's improper handling of highly compressed data, which can result in excessive resource consumption such as high CPU usage and massive memory allocation. This flaw allows a remote attacker to exploit the decompression logic, potentially leading to denial-of-service (DoS) conditions on affected systems.
The second vulnerability (CVE-2025-66418) allows a malicious server to insert an unbounded number of links in the decompression chain, again resulting in high CPU usage and memory exhaustion. Both vulnerabilities are remotely exploitable and have been addressed in urllib3 version 2.6.0. Organizations using affected versions should update immediately to mitigate the risk of DoS attacks stemming from these decompression and streaming flaws.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A follow-up security report summarized the two urllib3 flaws as client denial-of-service risks stemming from unbounded decompression and streaming resource exhaustion, reinforcing the recommendation to upgrade to version 2.6.0 or later. This was reporting on the already disclosed vulnerabilities rather than a new incident.
A second high-severity urllib3 vulnerability affecting versions 1.0 through before 2.6.0 was disclosed, showing that the Streaming API could fully decode highly compressed responses in one operation while satisfying chunk requests. This could let a malicious server cause excessive CPU and memory consumption through decompressed data amplification.
A high-severity vulnerability affecting urllib3 versions 1.24 through before 2.6.0 was disclosed, describing how a malicious server could trigger virtually unlimited decompression steps, causing high CPU use and massive memory allocation. The issue was categorized as remotely exploitable denial of service under CWE-770.
The Python HTTP client library urllib3 released version 2.6.0 to fix two denial-of-service issues: an unbounded decompression-chain flaw (CVE-2025-66418) and a Streaming API resource-exhaustion flaw involving highly compressed responses (CVE-2025-66471). The fixes are referenced by upstream commits and GitHub Security Advisories.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important-rated security updates for `urllib3` across Red Hat Enterprise Linux 8, 9, and 10 to remediate `CVE-2026-44432` and `CVE-2026-44431`. The more severe issue, `CVE-2026-44432`, is a denial-of-service flaw in the Python HTTP client library that can let a remote attacker force excessive CPU and memory consumption when `urllib3` fully decompresses an HTTP response even though only a partial read was requested, or when it drains a connection after partial decompression. Red Hat assigned the bug a CVSS v3 score of 7.5 and mapped it to `CWE-409`. The advisories cover multiple package streams and architectures, including `python-urllib3` for RHEL 10, `python3.14-urllib3` for RHEL 9 and 10, and `python3.12-urllib3` for RHEL 8 and 9, with fixes delivered in versions such as `1.26.19-4.el10_2`, `2.6.3-2.el10_2`, `2.6.3-2.el9_8`, `1.26.19-3.el9_8`, and `1.26.19-3.el8_10`. Red Hat said the same updates also address `CVE-2026-44431`, an information disclosure flaw in which sensitive headers may be forwarded across origins during redirects, and listed affected offerings including Extended Update Support, Extended Life Cycle releases, and Red Hat Ansible Automation Platform 2.5 and 2.6 as fixed.
Aug 27, 2026
Red Hat Enterprise Linux users were alerted to multiple package-level vulnerabilities that can cause denial of service, affecting both **`urllib3`** and **Python Protobuf** components distributed for the platform. One advisory reported multiple flaws in **`urllib3`** that could be abused to disrupt application availability, while a separate advisory identified a denial-of-service vulnerability in **Python Protobuf**. The notices indicate that the impact is centered on service interruption rather than code execution, but the affected libraries are widely used in Python-based applications and backend services on Red Hat Enterprise Linux systems. Organizations running exposed or business-critical workloads that depend on these packages should prioritize reviewing installed versions, applying Red Hat-provided updates, and validating that dependent applications remain stable after remediation.
Jun 29, 2026
A newly disclosed denial-of-service vulnerability dubbed **HTTP/2 Bomb** (`CVE-2026-49975`) can let unauthenticated attackers crash vulnerable servers by abusing HTTP/2 header compression and flow-control behavior to amplify small requests into large in-memory allocations. Researchers said the flaw affects widely deployed infrastructure including **nginx**, **Apache httpd**, **Microsoft IIS**, **Envoy**, and **Cloudflare Pingora**, with early Internet scans identifying more than **880,000** potentially exposed websites. Security firms reported reconnaissance activity in the wild, and sectors with large numbers of Internet-facing systems—especially **telecommunications, IT, and healthcare**—were flagged as particularly exposed. A public proof-of-concept is now available for **Apache HTTP Server**, where affected versions **2.4.17 through 2.4.67** can be forced into sustained memory exhaustion through crafted HTTP/2 cookie headers and a zero-window flow-control technique that prevents resources from being released. Apache fixed the issue in **2.4.68**, while other vendors have rolled out patches or mitigations on uneven timelines, including earlier fixes from nginx and Apache, a next-day patch from Envoy, a later mitigation from Microsoft, and no patch yet reported for Cloudflare at the time of coverage. Defenders are being urged to **upgrade immediately**, consider temporarily disabling HTTP/2 where feasible, and watch for abnormal memory growth and other signs of attempted DoS activity.
Jun 29, 2026