{"id":"CVE-2025-66418","title":"urllib3 is a user-friendly HTTP client library for Python","summary":"urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of co…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-770"],"vendor":"python","product":"urllib3","affected":["urllib3 >= 1.24, < 2.6.0"],"patched":["urllib3 2.6.0"],"published":"2025-12-05","updated":"2026-09-25","sourceUpdated":"2026-09-25T23:10:00.463","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66418","references":[{"url":"https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8","label":"security-advisories@github.com"},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66418"},{"url":"https://github.com/urllib3/urllib3"}],"tags":["nvd","osv","pip"],"epss":0.00682,"epssPercentile":0.52266,"aliases":["GHSA-gm62-xv2j-4w53","PYSEC-2026-1998"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:49.735Z","slug":"CVE-2025-66418","body":"## Overview\n\nurllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.\n\n## Affected\n\n- `urllib3 >= 1.24, < 2.6.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `urllib3 2.6.0`\n\n## Package advisory (CVE-2025-66418)\n\nAffected packages:\n\n- `urllib3 >= 1.24, < 2.6.0`\n\nPatched in:\n\n- `urllib3 2.6.0`\n\nSource: https://osv.dev/vulnerability/GHSA-gm62-xv2j-4w53","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":211203,"id":"CVE-2025-66418","ts":1790378524202,"field":"cvss","old":null,"new":"7.5"}]}