CVE-2026-21441
📋 TL;DR
This vulnerability in urllib3 allows a malicious server to cause excessive resource consumption on clients through decompression bombs in HTTP redirect responses. It affects Python applications using urllib3's streaming API with preload_content=False when fetching content from untrusted sources. The issue occurs because redirect responses are fully decompressed without respecting read limits.
💻 Affected Systems
- urllib3
📦 What is this software?
Urllib3 by Python
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service on the client system due to memory exhaustion from decompression bombs, potentially crashing the application or consuming all available system resources.
Likely Case
Degraded performance or temporary unavailability of the affected application due to resource exhaustion when processing malicious redirects.
If Mitigated
Minimal impact if redirects are disabled for untrusted sources or the application is upgraded to a patched version.
🎯 Exploit Status
Exploitation requires a malicious server that the client connects to, but no authentication is needed on the client side.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.3
Vendor Advisory: https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99
Restart Required: No
Instructions:
1. Upgrade urllib3 to version 2.6.3 or later using pip: pip install --upgrade urllib3>=2.6.3
2. Verify the upgrade completed successfully
3. No application restart required for Python applications
🔧 Temporary Workarounds
Disable redirects for untrusted sources
allSet redirect=False when making requests to untrusted servers to prevent the vulnerable redirect handling
import urllib3
pool = urllib3.PoolManager()
response = pool.request('GET', 'http://untrusted.example.com', redirect=False)
🧯 If You Can't Patch
- Implement network controls to restrict outbound HTTP requests to trusted servers only
- Monitor system resource usage for abnormal memory consumption patterns
🔍 How to Verify
Check if Vulnerable:
Check urllib3 version: python -c "import urllib3; print(urllib3.__version__)". If version is between 1.22 and 2.6.2 inclusive, and application uses streaming with preload_content=False for untrusted sources, it's vulnerable.Check Version:
python -c "import urllib3; print(urllib3.__version__)"Verify Fix Applied:
After upgrade, verify version is 2.6.3 or higher: python -c "import urllib3; print(urllib3.__version__)"📡 Detection & Monitoring
Log Indicators:
- Unusually high memory usage in application logs
- Multiple redirect responses from single requests
- Slow response times or timeouts when fetching external content
Network Indicators:
- HTTP redirects to compressed content from untrusted sources
- Large compressed payloads in redirect responses
SIEM Query:
source="application_logs" AND ("memory exhaustion" OR "out of memory" OR "redirect loop") AND process="python"