CVE-2026-9375

Name of the Vulnerable Software and Affected Versions urllib3 version 2.6.3 Brotli version 1.2.0

Description A decompression bomb bypass exists in the streaming API (preload content=False) when Brotli support is used. This occurs because three independent code paths in response.py bypass the max length protection. Specifically, buffer arithmetic in read() can produce negative max length values, flush decoder unconditionally overrides max length to -1, and flush decoder() passes no limit, defaulting to unlimited decompression. A malicious HTTP server can exploit this to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, resulting in a denial of service (DoS).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.