Back to Database
Status published
High
CVE-2025-66418
urllib3 allows an unbounded number of links in the decompression chain
Vulnerability Description
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66418
Credits & Attribution
No credits recorded in the NVD database.
References
More from urllib3
View All →CVE-2025-66471
urllib3 Streaming API improperly handles highly compressed data
High
8.9
CVE-2025-50182
urllib3 does not control redirects in browsers and Node.js
Medium
5.3
CVE-2025-50181
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
Medium
5.3
CVE-2024-37891
Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3
Medium
4.4
CVE-2023-45803
Request body not stripped after redirect in urllib3
Medium
4.2
Affected Vendor
urllib3
View all reports →Affected Software
urllib3
Vulnerable Versions:
>= 1.24, < 2.6.0
Timeline
Official Publish:
December 5th, 2025
Last Modified:
December 5th, 2025
Added to House:
July 22nd, 2026