AI analysis
urllib3, the widely used Python HTTP client library, fails to bound how much data it buffers while parsing a chunked HTTP response: in versions from 1.10.3 up to (but not including) 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods read the chunk-size line until a newline or EOF with no length limit. A malicious or compromised HTTP server triggers the flaw by replying with 'Transfer-Encoding: chunked' followed by an extremely long run of bytes containing no newline, causing the client to allocate unbounded memory and eventually exhaust the process. Any application built on an affected urllib3 that makes requests to servers it does not fully control, including apps that fetch user-supplied or third-party URLs, is at risk of denial of service; the CVSS 4.0 score is 8.9 (high), reflecting a network attack vector with high availability impact but requiring the attacker to operate a hostile server. The flaw is fixed in urllib3 2.8.0. As of this writing there is no known public PoC, and it does not appear in the CISA KEV catalog.
What to do: Upgrade to urllib3 2.8.0 or later, and update any lockfiles, base images, or vendored copies that pin an older version. Because urllib3 is almost always pulled in as a transitive dependency, run pip-audit or 'pip show urllib3' to confirm the resolved version across your projects. Highest-risk applications are those that fetch user-supplied or otherwise untrusted URLs; as interim mitigations, cap response sizes, enforce process memory limits, and restrict outbound HTTP to trusted hosts.
Affected
| urllib3 project (Python) urllib3 | >= 1.10.3, < 2.8.0 |
Estimated exposure
massTens of millions to hundreds of millions of Python environments worldwide — urllib3 is one of the most-downloaded PyPI packages (hundreds of millions of downloads per month) and ships as a transitive dependency of extremely popular packages such as requests, botocore/boto3, and pip itself, implying a comparable…
Description
urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.