Illia-V

**Name of the Vulnerable Software and Affected Versions** urllib3 versions 1.22 through 2.6.2 **Description** urllib3 is a Python HTTP client library. Its streaming API is designed for efficient handling of large HTTP responses by reading content in chunks. The library decompresses content based on the HTTP `Content-Encoding` header, such as `gzip`, `deflate`, `br`, or `zstd`. When using the streaming API with HTTP redirects and `preload content` set to `False`, versions prior to 2.6.3 would unnecessarily read and decompress the entire response body, even before any read methods were called. Configured read limits did not restrict the amount of decompressed data, creating a risk of decompression bombs. A malicious server could exploit this to cause excessive resource consumption on the client. Applications and libraries are affected when streaming content from untrusted sources without disabling redirects. **Recommendations** Upgrade to urllib3 version 2.6.3 or later. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted sources.

**Name of the Vulnerable Software and Affected Versions** urllib3 versions prior to 2.5.0 **Description** The issue concerns urllib3, a Python HTTP client library, which does not control redirects in browsers and Node.js prior to version 2.5.0. This library supports being used in a Pyodide runtime, utilizing the JavaScript Fetch API or falling back on XMLHttpRequest, allowing Python libraries to make HTTP requests from a browser or Node.js. However, the retries and redirect parameters are ignored with Pyodide, as the runtime itself determines redirect behavior. Redirects can be used to exploit SSRF vulnerabilities, and applications attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects may remain vulnerable if a Pyodide runtime redirect mechanism is unsuitable. **Recommendations** For versions prior to 2.5.0, upgrade to a patched version of urllib3. As a temporary workaround, consider restricting the use of urllib3 in Pyodide runtime to minimize the risk of exploitation. Avoid relying on urllib3 to control the number of redirects for an HTTP request in a Pyodide runtime until the issue is resolved.