CVE-2026-9375: urllib3 2.6.3 Decompression Bomb Bypass via Brotli Streaming

Technical summary

CVE-2026-9375 exploits three separate code paths in urllib3 2.6.3's `response.py` that circumvent the `max_length` decompression limit introduced in version 2.6.0. When `preload_content=False` (streaming mode) is combined with Brotli decompression, the vulnerability manifests through: (1) negative `max_length` values resulting from buffer arithmetic in the `read()` method, (2) `flush_decoder()` unconditionally resetting `max_length` to -1, and (3) `_flush_decoder()` passing no limit parameter, defaulting to unlimited decompression. An attacker controlling the HTTP server can craft a high-compression-ratio payload that decompresses to a size exceeding available memory, triggering an out-of-memory condition. The issue is specific to Brotli and does not affect gzip or deflate decoders in the same version.

Business impact

Organizations relying on urllib3 or requests to consume streaming content from untrusted or semi-trusted sources face immediate denial of service risk. Web services, data pipelines, and automated tools that process HTTP responses without explicit decompression limits are susceptible to crash-on-download attacks. The impact is particularly acute in multi-tenant environments or cloud deployments where a single malicious response can starve resources for other workloads. Incident response teams should assess whether affected deployments download from external or user-controlled sources.

Affected systems

The vulnerability is confirmed in urllib3 version 2.6.3 with Brotli 1.2.0 support enabled. Any Python application or library using urllib3 2.6.3 in streaming mode (`preload_content=False`) with Brotli decompression is in scope. The popular `requests` library, when used with urllib3 2.6.3, inherits this risk if requests are made to untrusted endpoints. Verify your urllib3 version with `pip show urllib3` and check whether Brotli support is installed via `pip show brotli`. Applications using only gzip or deflate compression, or those with urllib3 versions prior to 2.6.3 or after a patched release, are not affected by this specific flaw.

Exploitability

Exploitation requires no authentication and no user interaction. An attacker must control or compromise the HTTP endpoint from which the target application retrieves data. The attack is straightforward: craft a Brotli-compressed response with a legitimate compression header and high compression ratio. No client-side exploit code or unusual request patterns are needed. The barrier to exploitation is network position—the attacker must be able to serve or intercept HTTP responses. Given the simplicity of the attack surface and the lack of client-side complexity, this is a network-accessible vulnerability with low technical barriers.

Remediation

Patch urllib3 to a version released after 2026-06-22 that addresses the three code path bypasses. Coordinate with your dependency manager to ensure the patched version is deployed. If immediate patching is not feasible, disable Brotli decompression by uninstalling the `brotli` package (fallback to gzip/deflate is automatic), or configure applications to avoid streaming mode (`preload_content=True`) when consuming data from less-trusted sources, though this increases memory overhead. For long-term resilience, implement explicit decompression limits in application code and monitor streaming responses for unexpectedly large decompressed sizes.

Patch guidance

Monitor the urllib3 project repository and PyPI for a patched release addressing CVE-2026-9375. Apply patches to all Python environments where urllib3 2.6.3 is installed. Test the patched version in development before production deployment to ensure compatibility with your application's HTTP behavior. If you maintain downstream libraries that depend on urllib3, coordinate with your users to upgrade. Verify the patch by checking that the three identified code paths—`read()` buffer arithmetic, `flush_decoder()` max_length override, and `_flush_decoder()` limit parameter—are corrected in the release notes.

Detection guidance

Look for urllib3 version 2.6.3 in dependency logs and container images. Check application logs for out-of-memory errors or crashes coinciding with HTTP requests to external endpoints, particularly if those endpoints deliver Brotli-compressed responses. Use static analysis to identify calls to `response.read()` or `response.stream()` with `preload_content=False` in your codebase. Monitor process memory usage during streaming downloads; unusual spikes without corresponding application logic may indicate decompression bomb activity. SIEM rules can flag HTTP responses with atypical compression ratios or unusually large decompressed sizes relative to Content-Length headers.

Why prioritize this

This vulnerability merits immediate attention despite the requirement for network position because: (1) the attack surface is broad—any streaming HTTP client is in scope, (2) the exploitation is trivial and requires no sophisticated tooling, (3) the impact is severe and cascading (DoS can bring down services), and (4) urllib3 is ubiquitous in Python ecosystems, affecting many organizations transitively through requests or other libraries. Organizations downloading from external APIs, webhooks, or user-uploaded content should prioritize patching.

Risk score, explained

The CVSS 3.0 score of 7.5 (HIGH) reflects a network-accessible vulnerability with no authentication, low complexity, and direct availability impact. The score appropriately captures the severity of a remote crash condition but does not account for the requirement that the attacker control the HTTP endpoint. In practice, the risk is elevated for applications consuming data from untrusted sources but lower for internal-only HTTP communication. Prioritize patching based on whether your applications make streaming requests to external, user-controlled, or compromisable endpoints.

Frequently asked questions