urllib3 2.6.0 security fixes

{
  "id": "8311f03e38963b0a5118510ef05109fd666760c877d445c894016d6929d33dc4",
  "url": "https://github.com/urllib3/urllib3/releases/tag/2.6.0",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "urllib3 2.6.0 security fixes",
    "summary": "urllib3 2.6.0 fixes two denial-of-service security issues involving highly compressed HTTP content and excessive chained Content-Encoding values. The release also advises users with separately installed Brotli implementations to upgrade them to specified versions.",
    "evidence": "Release notes from urllib3\n2.6.0\n\n🚀 urllib3 is fundraising for HTTP/2 support urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul. Thank you for your support. Security Fixed a security issue where streaming API could improperly handle highly compressed HTTP content (\"decompression bombs\") leading to excessive resource consumption even when a small amount of data was requested.",
    "products": [
      {
        "name": {
          "value": "urllib3",
          "evidence": "Release notes from urllib3"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.6.0",
            "evidence": "2.6.0"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Brotli",
          "evidence": "upgrade it to at least Brotli 1.2.0"
        },
        "prerequisites": [
          {
            "value": "If urllib3 is not installed with the optional urllib3[brotli] extra, but your environment contains a Brotli/brotlicffi/brotlipy package anyway",
            "evidence": "If urllib3 is not installed with the optional urllib3[brotli] extra, but your environment contains a Brotli/brotlicffi/brotlipy package anyway"
          }
        ],
        "fixed_versions": [
          {
            "value": "Brotli 1.2.0",
            "evidence": "upgrade it to at least Brotli 1.2.0"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "brotlicffi",
          "evidence": "upgrade it to at least Brotli 1.2.0 or brotlicffi 1.2.0.0"
        },
        "prerequisites": [
          {
            "value": "If urllib3 is not installed with the optional urllib3[brotli] extra, but your environment contains a Brotli/brotlicffi/brotlipy package anyway",
            "evidence": "If urllib3 is not installed with the optional urllib3[brotli] extra, but your environment contains a Brotli/brotlicffi/brotlipy package anyway"
          }
        ],
        "fixed_versions": [
          {
            "value": "brotlicffi 1.2.0.0",
            "evidence": "upgrade it to at least Brotli 1.2.0 or brotlicffi 1.2.0.0"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [
      {
        "cve": "CVE-2025-66471",
        "product": "urllib3",
        "evidence": "urllib3 is fundraising for HTTP/2 support urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul. Thank you for your support. Security Fixed a security issue where streaming API could improperly handle highly compressed HTTP content (\"decompression bombs\") leading to excessive resource consumption even when a small amount of data was requested. Reading small chunks of compressed data is safer and much more efficient now. (CVE-2025-66471"
      }
    ],
    "related_cves": [
      {
        "value": "CVE-2025-66471",
        "evidence": "(CVE-2025-66471 reported by @Cycloctane, 8.9 High, GHSA-2xpw-w6gg-jr37)"
      },
      {
        "value": "CVE-2025-66418",
        "evidence": "(CVE-2025-66418 reported by @illia-v, 8.9 High, GHSA-gm62-xv2j-4w53)"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-urllib3-urllib3",
  "document_id": 22816,
  "published_at": "2025-12-05T15:45:09+00:00"
}