CVE-2026-9375

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.

• CWE-400

• https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a
• https://huntr.com/bounties/ddd09eb9-b87d-4a43-84df-48837b1bbc23
• https://huntr.com/bounties/ddd09eb9-b87d-4a43-84df-48837b1bbc23

Published

Jun 19, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9369A security flaw has been discovered in NousResearch hermes-a…5.3
• CVE-2026-9370A weakness has been identified in ulisesbocchio jasypt-sprin…3.7
• CVE-2026-9371A security vulnerability has been detected in ItzCrazyKns Va…5.6
• CVE-2026-9372A flaw has been found in ItzCrazyKns Vane up to 1.12.1. This…7.3
• CVE-2026-9373A vulnerability has been found in JeecgBoot 3.9.1. This issu…6.3
• CVE-2026-9374A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3…6.3
• CVE-2026-9376A vulnerability was determined in JPress up to 1.0.3. The af…6.3
• CVE-2026-9377A vulnerability was identified in SourceCodester SUP Online …2.4
• CVE-2026-9378A security flaw has been discovered in Edimax BR-6675nD 1.12…6.3
• CVE-2026-9379A weakness has been identified in Edimax BR-6675nD 1.12. Thi…6.3
• CVE-2026-9380A security vulnerability has been detected in Edimax BR-6675…8.8
• CVE-2026-9381A vulnerability was detected in Edimax BR-6675nD 1.12. Affec…8.8