urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has a package installed that is affected by a vulnerability as referenced in the USN-7955-1 advisory.

    It was discovered that urllib3 incorrectly handled decompression during HTTP redirects. An attacker could     possibly use this issue to cause urllib3 to use excessive resources, causing a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-724d1b1044 advisory.

    ### 2.6.3 (2026-01-07)

    - Fixed a high-severity security issue where decompression-bomb safeguards of     the streaming API were bypassed when HTTP redirects were followed.
    [`GHSA-38jv-5279-wg99`](https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99),     [`CVE-2026-21441`](https://www.cve.org/CVERecord?id=CVE-2026-21441)
    - Started treating `Retry-After` times greater than 6 hours as 6 hours by default.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient     handling of large HTTP responses by reading the content in chunks, rather than loading the entire response     body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-     Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library     decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and     prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to     drain the connection and decompress the content unnecessarily. This decompression occurred even before any     read methods were called, and configured read limits did not restrict the amount of decompressed data. As     a result, there was no safeguard against decompression bombs. A malicious server could exploit this to     trigger excessive resource consumption on the client. Applications and libraries are affected when they     stream content from untrusted sources by setting `preload_content=False` when they do not disable     redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content     of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable     redirects by setting `redirect=False` for requests to untrusted source. (CVE-2026-21441)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
284661	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : urllib3 vulnerability (USN-7955-1)	Nessus	Ubuntu Local Security Checks	high
282547	Fedora 43 : python-urllib3 (2026-724d1b1044)	Nessus	Fedora Local Security Checks	high
282456	Linux Distros Unpatched Vulnerability : CVE-2026-21441	Nessus	Misc.	high

Detections

Analytics

CVE-2026-21441

high

Tenable Plugins

high

high

high