CVE-2026-9375

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (preload_content=False) when using Brotli support. The issue arises due to three independent code paths in response.py that bypass the max_length protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative max_length values can be produced due to buffer arithmetic in read(), flush_decoder unconditionally overrides max_length to -1, and _flush_decoder() passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using requests or urllib3 to stream content from untrusted sources.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9375.json",
    "cna_assigner": "@huntr_ai",
    "cwe_ids": [
        "CWE-400"
    ]
}

References

Affected packages

Git / github.com/urllib3/urllib3

Affected ranges

Type

GIT

Repo

https://github.com/urllib3/urllib3

Events

Introduced

Fixed

2bdcc44d1e163fb5cc48a8662425e35e15adfe6a

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.7.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.3

0.3.1

0.4

0.4.1

1.*

1.1

1.2

1.2.1

1.25

1.25.1

1.25.2

1.25.3

1.25.4

1.25.5

1.25.6

1.25.7

1.25.8

1.3

1.4

1.5

1.6

1.7

1.7.1

2.*

2.0.0

2.0.0a1

2.0.0a2

2.0.0a3

2.0.0a4

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.1.0

2.2.0

2.2.1

2.2.2

2.2.3

2.3.0

2.4.0

2.5.0

2.6.0

2.6.1

2.6.2

2.6.3

v2.*

v2.0.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9375.json"