urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries using `requests` or `urllib3` to stream content from untrusted sources.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3397-1 advisory.

    This update for python-urllib3 fixes the following issue

    - CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a     denial of       service (bsc#1268683).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:22863-1 advisory.

    This update for python-urllib3 fixes the following issue

    - CVE-2026-9375: decompression bomb bypass in the streaming API  when using Brotli support can lead to a     denial of       service (bsc#1268683).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21430-1 advisory.

    This update for python-urllib3 fixes the following issue

    - CVE-2026-9375: decompression bomb bypass in the streaming API  when using Brotli support can lead to a     denial of       service (bsc#1268683).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API     (`preload_content=False`) when using Brotli support. The issue arises due to three independent code paths     in `response.py` that bypass the `max_length` protection introduced in version 2.6.0 to mitigate     CVE-2025-66471. Specifically, negative `max_length` values can be produced due to buffer arithmetic in     `read()`, `flush_decoder` unconditionally overrides `max_length` to `-1`, and `_flush_decoder()` passes no     limit at all, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an     out-of-memory (OOM) condition by decompressing large payloads into memory, leading to a denial of service     (DoS). The vulnerability affects urllib3 2.6.3 and Brotli 1.2.0 and impacts applications and libraries     using `requests` or `urllib3` to stream content from untrusted sources. (CVE-2026-9375)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
331465	SUSE SLED15 / SLES15 Security Update : python-urllib3 (SUSE-SU-2026:3397-1)	Nessus	SuSE Local Security Checks	high
330328	SUSE SLES16 Security Update : python-urllib3 (SUSE-SU-2026:22863-1)	Nessus	SuSE Local Security Checks	high
329717	openSUSE 16 Security Update : python-urllib3 (openSUSE-SU-2026:21430-1)	Nessus	SuSE Local Security Checks	high
324560	Photon OS 5.0: Python3 PHSA-2026-5.0-0911	Nessus	PhotonOS Local Security Checks	high
321837	Linux Distros Unpatched Vulnerability : CVE-2026-9375	Nessus	Misc.	high

Detections

Analytics

CVE-2026-9375

high

Tenable Plugins

high

high

high

high

high