{"id":"CVE-2025-66418","aliases":["GHSA-gm62-xv2j-4w53","PYSEC-2026-1998"],"title":"urllib3 allows an unbounded number of links in the decompression chain","summary":"urllib3 allows an unbounded number of links in the decompression chain","severity":"high","vendor":"urllib3","product":"urllib3","ecosystem":"pip","affected":["urllib3 >= 1.24, < 2.6.0"],"patched":["urllib3 2.6.0"],"published":"2025-12-05","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:58.741847479Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-gm62-xv2j-4w53","references":[{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66418"},{"url":"https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8"},{"url":"https://github.com/urllib3/urllib3"}],"tags":["osv","pip"],"epss":0.00682,"epssPercentile":0.51073,"ingestedAt":"2026-07-08T18:25:49.735Z","slug":"CVE-2025-66418","body":"## Overview\n\n## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected usages\n\nApplications and libraries using urllib3 version 2.5.0 and earlier for HTTP requests to untrusted sources unless they disable content decoding explicitly.\n\n\n## Remediation\n\nUpgrade to at least urllib3 v2.6.0 in which the library limits the number of links to 5.\n\nIf upgrading is not immediately possible, use [`preload_content=False`](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) and ensure that `resp.headers[\"content-encoding\"]` contains a safe number of encodings before reading the response content.\n\n## Affected packages\n\n- `urllib3 >= 1.24, < 2.6.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `urllib3 2.6.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}