CVE-2026-9375: Decompression Bomb Bypass via Negative max_length in Streaming API in urllib3
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
urllib3to a version that resolves this vulnerability.Fixed in 2.6.3 - Upgrade
Upgrade
Brotlito a version that resolves this vulnerability.Fixed in 1.2.0 - Compensating control
Mitigate the decompression bomb DoS by ensuring requests/urllib3 streaming from untrusted sources does not enable the Brotli decompression bypass in urllib3’s streaming API with `preload_content=False`.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9375?
The severity of CVE-2026-9375 is rated as high with a score of 7.5.
What does CVE-2026-9375 affect?
CVE-2026-9375 affects urllib3 version 2.6.3 specifically when using Brotli support.
How can I fix CVE-2026-9375?
To fix CVE-2026-9375, upgrade urllib3 to a version later than 2.6.3 where the vulnerability is addressed.
What is a decompression bomb in the context of CVE-2026-9375?
A decompression bomb is a type of attack that exploits the way files are unpacked, potentially consuming excessive resources.
What is the impact of exploiting CVE-2026-9375?
Exploiting CVE-2026-9375 can lead to denial of service due to resource exhaustion caused by decompression bomb bypass.