Executive Summary

This vulnerability in urllib3 versions from 1.24 up to but not including 2.6.0 allows a malicious server to create an unbounded number of compression steps in the decompression chain. This leads to excessive CPU usage and massive memory allocation when decompressing data, potentially causing performance degradation or denial of service.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause high CPU usage and large memory consumption on systems using affected versions of urllib3 when processing maliciously crafted compressed data. This can degrade system performance, cause application crashes, or lead to denial of service.

Useful 0 Not Useful 0

Mitigation Strategies

Update urllib3 to version 2.6.0 or later, as this version contains the fix for the vulnerability.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your system, you can check the version of urllib3 installed to see if it is >=1.24 and <2.6.0, which are vulnerable versions. For example, run the command `pip show urllib3` or `pip list | grep urllib3` to find the installed version. Additionally, to detect exploitation attempts on your network, monitor HTTP responses for the `Content-Encoding` header containing an excessive number of chained encodings (more than 5). You can use tools like `tcpdump` or `Wireshark` to capture HTTP traffic and filter for suspicious `Content-Encoding` headers. For example, using `tcpdump` to capture HTTP traffic: `tcpdump -A -s 0 'tcp port 80' | grep -i 'Content-Encoding'`. Then manually inspect if the header contains more than 5 encodings separated by commas. If you are processing HTTP responses in your application, you can add logging to check the length of the encoding chain in the `Content-Encoding` header before decompression. If immediate upgrade is not possible, disable automatic content decoding by setting `preload_content=False` and manually verify the number of encodings in the header to avoid resource exhaustion. [2, 1]

Useful 0 Not Useful 0