Към съдържанието
Търсене

CVE-2026-21441: urllib3, отказ на услуга

8.9

CVSS 4.0

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, само при определена конфигурация или състояние на системата, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.

Засегнати продукти

  • urllib3 urllib3: >= 1.22, < 2.6.3
  • Red Hat: още 107 продукта, добавени от Red Hat

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat OpenStack Platform 17.1 for RHEL 8, Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9, Red Hat Satellite 6.18 for RHEL 9, RHUI 4 for RHEL 8, cert-manager operator for Red Hat OpenShift 1.18, mirror registry for Red Hat OpenShift 2.0, Multicluster Global Hub 1.4.5, Network Observability (NETOBSERV) 1.11.0, OpenShift API for Data Protection 1.3, Red Hat Advanced Cluster Management for Kubernetes 2.14, Red Hat Advanced Cluster Management for Kubernetes 2.15, Red Hat Advanced Cluster Security 4.8, Red Hat Advanced Cluster Security 4.9, Red Hat AI Inference Server 3.2, Red Hat Ansible Automation Platform 2.4, Red Hat Ansible Automation Platform 2.5, Red Hat Ansible Automation Platform 2.6, Red Hat Ceph Storage 7.1, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, Red Hat Discovery 2, Red Hat Migration Toolkit 1.8, Red Hat multicluster global hub 1.5.3, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat OpenShift Dev Spaces (RHOSDS) 3.26, Red Hat OpenShift GitOps 1.17, Red Hat OpenShift GitOps 1.18, Red Hat OpenShift GitOps 1.19, Red Hat Quay 3.10, Red Hat Quay 3.12, Red Hat Quay 3.13, Red Hat Quay 3.14, Red Hat Quay 3.15, Red Hat Quay 3.16, Red Hat Satellite 6.17, Red Hat Satellite 6.18, Red Hat Trusted Artifact Signer 1.2, Red Hat Trusted Artifact Signer 1.3, Red Hat Update Infrastructure 5, Zero Trust Workload Identity Manager 1.0, Assisted Installer for Red Hat OpenShift Container Platform 2, Confidential Compute Attestation, Dynamic Accelerator Slicer Operator for Red Hat OpenShift, External Secrets Operator for Red Hat OpenShift, external secrets operator for Red Hat OpenShift - Tech Preview, Fence Agents Remediation Operator, Logging Subsystem for Red Hat OpenShift, Migration Toolkit for Containers, Migration Toolkit for Virtualization, Multiarch Tuning Operator, Multicluster Engine for Kubernetes, Node HealthCheck Operator, OpenShift API for Data Protection, OpenShift Developer Tools and Services, OpenShift Lightspeed, OpenShift Pipelines, OpenShift Serverless, OpenShift Service Mesh 2, OpenShift Service Mesh 3, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform Ansible Core 2, Red Hat build of Quarkus Native builder, Red Hat Certification Program for Red Hat Enterprise Linux 9, Red Hat Connectivity Link 1, Red Hat Developer Hub, Red Hat Edge Manager preview, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Offline Knowledge Portal, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4, Red Hat OpenShift Dev Spaces, Red Hat OpenShift GitOps, Red Hat OpenShift Update Service, Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0, Red Hat Quay 3, Red Hat Satellite 6, Self Node Remediation Operator, Service Telemetry Framework 1.5, Zero Trust Workload Identity Manager - Tech Preview

Вид слабост

История

  • 7 януари 2026 Публикувано

Други уязвимости в urllib3 urllib3

Първоизточници

CVE-2026-21441: urllib3, отказ на услуга | freedomonline.bg