PyPI: urllib3
CVE-2026-21441
Safety vulnerability ID: SFTY-20260107-76089
Safety legacy ID: pyup.io-84031
Affected versions of the urllib3 package are vulnerable to Denial of Service (DoS) due to redirect handling that drains connections by decompressing redirect response bodies without enforcing streaming read limits. The issue occurs when using urllib3’s streaming mode (for example, preload_content=False) while allowing redirects, because urllib3.response.HTTPResponse.drain_conn() would call HTTPResponse.read() in a way that decoded/decompressed the entire redirect response body even before any streaming reads were performed, effectively bypassing decompression-bomb safeguards.
Overview
Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
Advisory
Affected versions of the urllib3 package are vulnerable to Denial of Service (DoS) due to redirect handling that drains connections by decompressing redirect response bodies without enforcing streaming read limits. The issue occurs when using urllib3’s streaming mode (for example, preload_content=False) while allowing redirects, because urllib3.response.HTTPResponse.drain_conn() would call HTTPResponse.read() in a way that decoded/decompressed the entire redirect response body even before any streaming reads were performed, effectively bypassing decompression-bomb safeguards.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260107-76089/CVE-2026-21441
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21441
- https://github.com/advisories/GHSA-38jv-5279-wg99
- https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b
- https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99
- https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b
- https://nvd.nist.gov/vuln/detail/CVE-2026-21441
- https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html
- https://github.com/advisories/GHSA-38jv-5279-wg99
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more