https://seclists.org/oss-sec/2025/q4/250: CVE-2025-66418 & CVE-2025-66471 fixed in urllib3 2.6.0
Published Dec 5, 2025
·Updated
Affected Software
1 affected component
pypi/urllib3>=1.24<2.6.0
Frequently Asked Questions
1
What is the severity of CVE-2025-66418 and CVE-2025-66471?
CVE-2025-66418 and CVE-2025-66471 are considered to have a high severity due to their potential impact on security when handling unbounded links in the decompression chain.
2
How do I fix CVE-2025-66418 and CVE-2025-66471?
To fix CVE-2025-66418 and CVE-2025-66471, upgrade urllib3 to version 2.6.0 or later.
3
What versions of urllib3 are affected by CVE-2025-66418 and CVE-2025-66471?
CVE-2025-66418 and CVE-2025-66471 affect urllib3 versions greater than or equal to 1.24 and less than 2.6.0.
4
What kind of vulnerabilities are CVE-2025-66418 and CVE-2025-66471?
CVE-2025-66418 and CVE-2025-66471 involve vulnerabilities related to unbounded decompression leading to potential denial of service.
5
Where can I find more information about CVE-2025-66418 and CVE-2025-66471?
More information about CVE-2025-66418 and CVE-2025-66471 is available in the security advisory on the GitHub repository for urllib3.