CVE-2025-66418
📋 TL;DR
This vulnerability in urllib3 allows a malicious HTTP server to send specially crafted compressed responses that cause excessive CPU usage and memory allocation during decompression. It affects Python applications using urllib3 version 1.24 through 2.5.x to make HTTP requests. The attack can lead to denial of service through resource exhaustion.
💻 Affected Systems
- urllib3
📦 What is this software?
Urllib3 by Python
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service through CPU and memory exhaustion, potentially crashing the application or server.
Likely Case
Degraded performance and resource exhaustion affecting application availability.
If Mitigated
Limited impact with proper network segmentation and request filtering.
🎯 Exploit Status
Exploitation requires control over the HTTP server response, making it server-side initiated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.0
Vendor Advisory: https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53
Restart Required: Yes
Instructions:
1. Update urllib3: pip install --upgrade urllib3>=2.6.0
2. Restart all Python applications using urllib3
3. Verify the update with: pip show urllib3
🔧 Temporary Workarounds
Limit compression chain depth
allConfigure urllib3 to limit the maximum decompression chain length
import urllib3
http = urllib3.PoolManager(max_decompression_chains=10)
Disable compression
allDisable automatic decompression of HTTP responses
import urllib3
http = urllib3.PoolManager(automatic_decompression=False)
🧯 If You Can't Patch
- Implement network controls to restrict HTTP requests to trusted servers only
- Deploy rate limiting and resource monitoring to detect abnormal resource consumption
🔍 How to Verify
Check if Vulnerable:
Check urllib3 version: python -c "import urllib3; print(urllib3.__version__)"Check Version:
python -c "import urllib3; print(urllib3.__version__)"Verify Fix Applied:
Verify version is 2.6.0 or higher: python -c "import urllib3; print('Vulnerable' if urllib3.__version__ < '2.6.0' else 'Patched')"📡 Detection & Monitoring
Log Indicators:
- Unusually high CPU usage by Python processes
- Memory allocation spikes during HTTP requests
- Application crashes or timeouts during HTTP operations
Network Indicators:
- HTTP responses with multiple compression headers
- Unusual traffic patterns to/from Python applications
SIEM Query:
source="application.logs" AND ("urllib3" OR "HTTP request") AND ("high cpu" OR "memory spike" OR "decompression")