urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

oracle CPUJan2026: Business Intelligence Enterprise Edition

oracle CPUJan2026: Application Testing Suite

oracle CPUJan2026: Oracle E-Business Suite

oracle CPUJan2026: Enterprise Manager Base Platform

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1367 advisory.

    urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0,     the number of links in the decompression chain was unbounded allowing a malicious server to insert a     virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation     for the decompressed data. This vulnerability is fixed in 2.6.0. (CVE-2025-66418)

    urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the     Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the     efficient handling of large HTTP responses by reading the content in chunks, rather than loading the     entire response body into memory at once. When streaming a compressed response, urllib3 can perform     decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd).
    The library must read compressed data from the network and decompress it until the requested chunk size is     met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for     the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of     highly compressed data in a single operation. This can result in excessive resource consumption (high CPU     usage and massive memory allocation for the decompressed data. (CVE-2025-66471)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1366 advisory.

    urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0,     the number of links in the decompression chain was unbounded allowing a malicious server to insert a     virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation     for the decompressed data. This vulnerability is fixed in 2.6.0. (CVE-2025-66418)

    urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the     Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the     efficient handling of large HTTP responses by reading the content in chunks, rather than loading the     entire response body into memory at once. When streaming a compressed response, urllib3 can perform     decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd).
    The library must read compressed data from the network and decompress it until the requested chunk size is     met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for     the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of     highly compressed data in a single operation. This can result in excessive resource consumption (high CPU     usage and massive memory allocation for the decompressed data. (CVE-2025-66471)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1368 advisory.

    urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0,     the number of links in the decompression chain was unbounded allowing a malicious server to insert a     virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation     for the decompressed data. This vulnerability is fixed in 2.6.0. (CVE-2025-66418)

    urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the     Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the     efficient handling of large HTTP responses by reading the content in chunks, rather than loading the     entire response body into memory at once. When streaming a compressed response, urllib3 can perform     decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd).
    The library must read compressed data from the network and decompress it until the requested chunk size is     met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for     the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of     highly compressed data in a single operation. This can result in excessive resource consumption (high CPU     usage and massive memory allocation for the decompressed data. (CVE-2025-66471)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-66418 advisory.

  - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0,     the number of links in the decompression chain was unbounded allowing a malicious server to insert a     virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation     for the decompressed data. This vulnerability is fixed in 2.6.0. (CVE-2025-66418)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of CBL-Mariner Releases installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-66418 advisory.

  - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0,     the number of links in the decompression chain was unbounded allowing a malicious server to insert a     virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation     for the decompressed data. This vulnerability is fixed in 2.6.0. (CVE-2025-66418)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3126 advisory.

    urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0,     the number of links in the decompression chain was unbounded allowing a malicious server to insert a     virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation     for the decompressed data. This vulnerability is fixed in 2.6.0. (CVE-2025-66418)

    urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the     Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the     efficient handling of large HTTP responses by reading the content in chunks, rather than loading the     entire response body into memory at once. When streaming a compressed response, urllib3 can perform     decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd).
    The library must read compressed data from the network and decompress it until the requested chunk size is     met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for     the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of     highly compressed data in a single operation. This can result in excessive resource consumption (high CPU     usage and massive memory allocation for the decompressed data. (CVE-2025-66471)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python3-urllib3 installed on the remote host is prior to 1.25.6-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3127 advisory.

    urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with     `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected.
    However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally     configure the `Proxy-Authorization` header even though it won't have any effect as the request is not     using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-     Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on     cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this     vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip     the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are     doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve     safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default     in order to further protect users who aren't using the correct approach. We believe the number of usages     affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting     the `Proxy-Authorization` header without using urllib3's built-in proxy support. 2. Not disabling HTTP     redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a     malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to     upgrade may use the `Proxy-Authorization` header with urllib3's `ProxyManager`, disable HTTP redirects     using `redirects=False` when sending requests, or not user the `Proxy-Authorization` header as     mitigations. (CVE-2024-37891)

    urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0,     the number of links in the decompression chain was unbounded allowing a malicious server to insert a     virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation     for the decompressed data. This vulnerability is fixed in 2.6.0. (CVE-2025-66418)

    urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the     Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the     efficient handling of large HTTP responses by reading the content in chunks, rather than loading the     entire response body into memory at once. When streaming a compressed response, urllib3 can perform     decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd).
    The library must read compressed data from the network and decompress it until the requested chunk size is     met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for     the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of     highly compressed data in a single operation. This can result in excessive resource consumption (high CPU     usage and massive memory allocation for the decompressed data. (CVE-2025-66471)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6102 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6102-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     January 17, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : python-urllib3     CVE ID         : CVE-2025-50181 CVE-2025-66418 CVE-2026-21441     Debian Bug     : 1108076 1122030 1125062

    Several vulnerabilities were discovered in python-urllib3, a HTTP     library with thread-safe connection pooling for Python3, which could     result in denial of service or request forgery.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 1.26.12-1+deb12u2.

    For the stable distribution (trixie), these problems have been fixed in     version 2.3.0-3+deb13u1.

    We recommend that you upgrade your python-urllib3 packages.

    For the detailed security status of python-urllib3 please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/python-urllib3

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

The version of python-urllib3 installed on the remote host is prior to 1.25.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3110 advisory.

    urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0,     the number of links in the decompression chain was unbounded allowing a malicious server to insert a     virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation     for the decompressed data. This vulnerability is fixed in 2.6.0. (CVE-2025-66418)

    urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the     Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the     efficient handling of large HTTP responses by reading the content in chunks, rather than loading the     entire response body into memory at once. When streaming a compressed response, urllib3 can perform     decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd).
    The library must read compressed data from the network and decompress it until the requested chunk size is     met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for     the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of     highly compressed data in a single operation. This can result in excessive resource consumption (high CPU     usage and massive memory allocation for the decompressed data. (CVE-2025-66471)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4421 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4421-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     December 26, 2025                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-urllib3     Version        : 1.26.5-1~exp1+deb11u2     CVE ID         : CVE-2025-50181 CVE-2025-66418     Debian Bug     : 1108076 1122030

    Vulnerabilities were found in python-urllib3, an HTTP library with     thread-safe connection pooling for Python, which could lead to denial of     service or request forgery.

    CVE-2025-50181

        Redirects were not disabled when retries are disabled on PoolManager         instantiation.  An application attempting to mitigate SSRF or open         redirect vulnerabilities by disabling redirects at the PoolManager         level remained vulnerable.

    CVE-2025-66418

        The number of links in the decompression chain was unbounded,         allowing a malicious server to insert a virtually unlimited number         of compression steps which could lead to denial of service.

    For Debian 11 bullseye, these problems have been fixed in version     1.26.5-1~exp1+deb11u2.

    We recommend that you upgrade your python-urllib3 packages.

    For the detailed security status of python-urllib3 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-urllib3

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0972 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-66418:
    urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0,     the number of links in the decompression chain was unbounded allowing a malicious server to insert a     virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation     for the decompressed data. This vulnerability is fixed in 2.6.0.

    CVE-2025-50181:
    urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable     redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable     redirects. By default, requests and botocore users are not affected. An application attempting to mitigate     SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain     vulnerable. This issue has been patched in version 2.5.0.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7927-1 advisory.

    Illia Volochii discovered that urllib3 did not limit the steps in a decompression chain. An attacker could     possibly use this issue to cause urllib3 to use excessive resources, causing a denial of service.
    (CVE-2025-66418)

    Rui Xi discovered that urllib3 incorrectly handled highly compressed data. An attacker could possibly use     this issue to cause urllib3 to use excessive resources, causing a denial of service. This issue only     affected Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-66471)

    For the brotli encoding, the fix for CVE-2025-66471 requires an additional security update in the brotli     package.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-d93200cf16 advisory.

    Update `brotli` to [1.2.0](https://github.com/google/brotli/blob/v1.2.0/CHANGELOG.md) and `python-urllib3`     to [2.6.1](https://github.com/urllib3/urllib3/blob/2.6.1/CHANGES.rst).

    In python-urllib3:

    - Fixed a security issue where streaming API could improperly handle highly       compressed HTTP content (decompression bombs) leading to excessive resource       consumption even when a small amount of data was requested. Reading small       chunks of compressed data is safer and much more efficient now.
      (CVE-2025-66471 / [`GHSA-2xpw-w6gg-     jr37](https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37))
    - Fixed a security issue where an attacker could compose an HTTP response with       virtually unlimited links in the `Content-Encoding` header, potentially       leading to a denial of service (DoS) attack by exhausting system resources       during decoding. The number of allowed chained encodings is now limited to 5.
      (CVE-2025-66418 / [`GHSA-gm62-xv2j-4w53](https://github.com/urllib3/urllib3/security/advisories/GHSA-     gm62-xv2j-4w53))

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0,     the number of links in the decompression chain was unbounded allowing a malicious server to insert a     virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation     for the decompressed data. This vulnerability is fixed in 2.6.0. (CVE-2025-66418)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
296232	Amazon Linux 2023 : python3.12-pip, python3.12-pip-wheel (ALAS2023-2026-1367)	Nessus	Amazon Linux Local Security Checks	high
296231	Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2026-1366)	Nessus	Amazon Linux Local Security Checks	high
296227	Amazon Linux 2023 : python3.11-pip, python3.11-pip-wheel (ALAS2023-2026-1368)	Nessus	Amazon Linux Local Security Checks	high
295019	Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2025-66418)	Nessus	Azure Linux Local Security Checks	high
295006	CBL Mariner 2.0 Security Update: CBL-Mariner Releases (CVE-2025-66418)	Nessus	MarinerOS Local Security Checks	high
294894	Amazon Linux 2 : python-pip, --advisory ALAS2-2026-3126 (ALAS-2026-3126)	Nessus	Amazon Linux Local Security Checks	high
294890	Amazon Linux 2 : python3-urllib3, --advisory ALAS2-2026-3127 (ALAS-2026-3127)	Nessus	Amazon Linux Local Security Checks	high
291292	Debian dsa-6102 : python3-urllib3 - security update	Nessus	Debian Local Security Checks	high
282303	Photon OS 4.0: Python3 PHSA-2026-4.0-0938	Nessus	PhotonOS Local Security Checks	high
281844	Photon OS 5.0: Python3 PHSA-2026-5.0-0726	Nessus	PhotonOS Local Security Checks	high
281822	Amazon Linux 2 : python-urllib3, --advisory ALAS2-2025-3110 (ALAS-2025-3110)	Nessus	Amazon Linux Local Security Checks	high
280071	Debian dla-4421 : python3-urllib3 - security update	Nessus	Debian Local Security Checks	high
279991	TencentOS Server 4: python-urllib3 (TSSA-2025:0972)	Nessus	Tencent Local Security Checks	high
278513	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : urllib3 vulnerabilities (USN-7927-1)	Nessus	Ubuntu Local Security Checks	high
278404	Fedora 43 : brotli / perl-Alien-Brotli / python-urllib3 (2025-d93200cf16)	Nessus	Fedora Local Security Checks	high
277666	Linux Distros Unpatched Vulnerability : CVE-2025-66418	Nessus	Misc.	high

Detections

Analytics

CVE-2025-66418

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high