CVE-2025-66418

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-770"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66418.json"
}

References

Affected packages

Git / github.com/urllib3/urllib3

Affected ranges

Type

GIT

Repo

https://github.com/urllib3/urllib3

Events

Introduced

ef0c74542abe69421a86c4d3c6a86fe43cb809a4

Fixed

720f484b605f18887a48eef448d0084e2b76902d

Fixed

24d7b67eac89f94e11003424bcf0d8f7b72222a8

Database specific

Show details

{
    "cpe":  "cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "1.24"
        },
        {
            "fixed":  "2.6.0"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-66418.json"