urllib3 v1.22v2.6.3 Redirect Stream Decompress Bomb (preload_content=False)
CVE-2026-21441 Published on January 7, 2026

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.

NVD

Vulnerability Analysis

CVE-2026-21441 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Type

What is a Data Amplification Vulnerability?

The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output. An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.

CVE-2026-21441 has been classified to as a Data Amplification vulnerability or weakness.


Products Associated with CVE-2026-21441

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-21441 are published in these products:

Oracle
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Openstack
 
Red Hat Rhui
 
Red Hat Satellite
 
Red Hat Satellite Capsule
 
Red Hat Satellite Utils
 
Red Hat Satellite Maintenance
 
Red Hat Rhel Aus
 
Red Hat Rhel Eus Long Life
 
Red Hat Rhel E4s
 
Red Hat Rhel Tus
 
Red Hat Rhel Eus
 
Red Hat Enterprise Linux Eus
 
Red Hat Multicluster Globalhub
 
Red Hat Network Observ Optr
 
Red Hat Openshift Api Data Protection
 
Red Hat Ai Inference Server
 
Red Hat Acm
 
Red Hat Advanced Cluster Security
 
Red Hat Ansible Automation Platform
 
Red Hat Ceph Storage
 
Red Hat Discovery
 
Red Hat Openshift Ai
 
Red Hat Openshift Devspaces
 
Red Hat Openshift Gitops
 
Red Hat Quay
 
Red Hat Trusted Artifact Signer
 
Red Hat Zero Trust Workload Identity Manager
 
Red Hat Cert Manager
 
Red Hat Mirror Registry
 
Red Hat External Secrets Operator
 
Red Hat Logging
 
Red Hat Rhmt
 
Red Hat Migration Toolkit Virtualization
 
Red Hat Multiarch Tuning Operator
 
Red Hat Multicluster Engine
 
Red Hat Ocp Tools
 
Red Hat Openshift Lightspeed
 
Red Hat Openshift Pipelines
 
Red Hat Serverless
 
Red Hat Ansible Core
 
Red Hat Quarkus
 
Red Hat Certifications
 
Red Hat Connectivity Link
 
Red Hat Rhdh
 
Red Hat Edge Manager
 
Red Hat Enterprise Linux Ai
 
Red Hat Offline Knowledge Portal
 
Red Hat Openshift
 
Red Hat Openshift Data Foundation
 
Red Hat Assisted Installer
 
Red Hat Confidential Compute Attestation
 
Red Hat Dynamic Accelerator Slicer
 
Red Hat Workload Availability Far
 
Red Hat Workload Availability Nhc
 
Red Hat Service Mesh
 
Red Hat Openshift Update Service
 
Red Hat Workload Availability Snr
 
Red Hat Stf
 

Affected Versions

urllib3: Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS): Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS): Red Hat OpenStack Platform 17.1: Red Hat RHUI 4 for RHEL 8: Red Hat Satellite 6.16 for RHEL 8: Red Hat Satellite 6.16 for RHEL 9: Red Hat Satellite 6.17 for RHEL 9: Red Hat Satellite 6.18 for RHEL 9: Red Hat Enterprise Linux AppStream (v. 8): Red Hat Enterprise Linux AppStream AUS (v.8.4): Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4): Red Hat Enterprise Linux AppStream AUS (v.8.6): Red Hat Enterprise Linux AppStream E4S (v.8.6): Red Hat Enterprise Linux AppStream TUS (v.8.6): Red Hat Enterprise Linux AppStream E4S (v.8.8): Red Hat Enterprise Linux AppStream TUS (v.8.8): Red Hat Enterprise Linux AppStream E4S (v.9.0): Red Hat Enterprise Linux AppStream E4S (v.9.2): Red Hat Enterprise Linux AppStream EUS (v.9.4): Red Hat Enterprise Linux AppStream EUS (v.9.6): Red Hat Enterprise Linux AppStream (v. 9): Red Hat Enterprise Linux BaseOS EUS (v. 10.0): Red Hat Enterprise Linux BaseOS (v. 10): Red Hat Enterprise Linux BaseOS (v. 8): Red Hat Enterprise Linux BaseOS AUS (v. 8.2): Red Hat Enterprise Linux BaseOS AUS (v.8.4): Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4): Red Hat Enterprise Linux BaseOS AUS (v.8.6): Red Hat Enterprise Linux BaseOS E4S (v.8.6): Red Hat Enterprise Linux BaseOS TUS (v.8.6): Red Hat Enterprise Linux BaseOS E4S (v.8.8): Red Hat Enterprise Linux BaseOS TUS (v.8.8): Red Hat Enterprise Linux BaseOS E4S (v.9.0): Red Hat Enterprise Linux BaseOS E4S (v.9.2): Red Hat Enterprise Linux BaseOS EUS (v.9.4): Red Hat Enterprise Linux BaseOS EUS (v.9.6): Red Hat Enterprise Linux BaseOS (v. 9): Red Hat Enterprise Linux HighAvailability (v. 8): Red Hat Enterprise Linux High Availability AUS (v.8.4): Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4): Red Hat Enterprise Linux High Availability E4S (v.8.6): Red Hat Enterprise Linux High Availability TUS (v.8.6): Red Hat Enterprise Linux High Availability E4S (v.8.8): Red Hat Enterprise Linux High Availability TUS (v.8.8): Red Hat Enterprise Linux High Availability E4S (v.9.0): Red Hat Enterprise Linux High Availability E4S (v.9.2): Red Hat Enterprise Linux High Availability EUS (v.9.4): Red Hat Multicluster Global Hub 1.4.5: Red Hat Multicluster Global Hub 1.5.4: Red Hat Network Observability (NETOBSERV) 1.11.2: Red Hat OpenShift API for Data Protection 1.3: Red Hat AI Inference Server 3.2: Red Hat Advanced Cluster Management for Kubernetes 2.14: Red Hat Advanced Cluster Management for Kubernetes 2.15: Red Hat Advanced Cluster Security for Kubernetes 4.8: Red Hat Advanced Cluster Security for Kubernetes 4.9: Red Hat Ansible Automation Platform 2.4: Red Hat Ansible Automation Platform 2.5: Red Hat Ansible Automation Platform 2.6: Red Hat Ceph Storage 7.1: Red Hat Ceph Storage 8: Red Hat Ceph Storage 9: Red Hat Discovery 2: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 3.3: Red Hat OpenShift Dev Spaces (RHOSDS) 3.26: Red Hat OpenShift GitOps 1.17: Red Hat OpenShift GitOps 1.18: Red Hat OpenShift GitOps 1.19: Red Hat Quay 3.12: Red Hat Quay 3.13: Red Hat Quay 3.14: Red Hat Quay 3.15: Red Hat Quay 3.16: Red Hat Quay 3.1: Red Hat Satellite 6.18: Red Hat Trusted Artifact Signer 1.2: Red Hat Trusted Artifact Signer 1.3: Red Hat Update Infrastructure 5: Red Hat Enterprise Linux ResilientStorage (v. 8): Red Hat Enterprise Linux ResilientStorage E4S (v.9.0): Red Hat Enterprise Linux Resilient Storage E4S (v.9.2): Red Hat Enterprise Linux Resilient Storage EUS (v.9.4): Red Hat Zero Trust Workload Identity Manager 1: cert-manager operator for Red Hat OpenShift 1.18: mirror registry for Red Hat OpenShift 2.0: External Secrets Operator for Red Hat OpenShift: Logging Subsystem for Red Hat OpenShift: Red Hat Migration Toolkit for Containers: Red Hat Migration Toolkit for Virtualization: Red Hat Multiarch Tuning Operator: Red Hat Multicluster Engine for Kubernetes: Red Hat OpenShift Developer Tools and Services: Red Hat OpenShift Lightspeed: Red Hat OpenShift Pipelines: Red Hat OpenShift Serverless: Red Hat AI Inference Server: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform Ansible Core 2: Red Hat build of Quarkus Native builder: Red Hat Certification Program for Red Hat Enterprise Linux 9: Red Hat Connectivity Link 1: Red Hat Developer Hub: Red Hat Edge Manager preview: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Offline Knowledge Portal: Red Hat OpenShift AI (RHOAI): Red Hat OpenShift Container Platform 4: Red Hat Openshift Data Foundation 4: Red Hat OpenShift Dev Spaces: Red Hat Satellite 6: Red Hat Zero Trust Workload Identity Manager - Tech Preview: Assisted Installer for Red Hat OpenShift Container Platform 2: Red Hat Confidential Compute Attestation: Dynamic Accelerator Slicer Operator for Red Hat OpenShift: external secrets operator for Red Hat OpenShift - Tech Preview: Red Hat Fence Agents Remediation Operator: Red Hat Node HealthCheck Operator: Red Hat OpenShift API for Data Protection: Red Hat OpenShift Service Mesh 2: Red Hat OpenShift Service Mesh 3: Red Hat Advanced Cluster Management for Kubernetes 2: Red Hat Enterprise Linux 6: Red Hat Enterprise Linux 7: Red Hat OpenShift GitOps: Red Hat OpenShift Update Service: Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 18.0: Red Hat Quay 3: Red Hat Self Node Remediation Operator: Red Hat Service Telemetry Framework 1.5:

Exploit Probability

EPSS
0.52%
Percentile
40.23%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.