Executive Summary

CVE-2026-9375 is a vulnerability in urllib3 version 2.6.3 related to its streaming API when using Brotli compression. The issue occurs because multiple code paths bypass the maximum decompression length protections, allowing a malicious server to send specially crafted compressed data that decompresses into very large payloads in memory.

Specifically, negative max_length values can arise due to buffer arithmetic in the read() method, the flush_decoder method forcibly sets max_length to -1, and the _flush_decoder() method does not limit decompression at all. This results in an attacker being able to trigger an out-of-memory condition by decompressing large amounts of data, causing a denial of service.

The vulnerability affects applications and libraries that use urllib3 or requests to stream content from untrusted sources with Brotli compression enabled.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a denial-of-service (DoS) condition by causing the affected application to consume excessive memory when decompressing maliciously crafted Brotli-compressed data.

An attacker controlling an HTTP server can exploit this by sending large compressed payloads that bypass decompression limits, causing the client application to run out of memory and potentially crash or become unresponsive.

This impacts the availability of services relying on urllib3 or requests for streaming content, especially when handling data from untrusted or external sources.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves monitoring for abnormal memory usage or out-of-memory (OOM) conditions when streaming HTTP responses using urllib3 with Brotli decompression enabled.

Specifically, detection can focus on identifying applications using urllib3 version 2.6.3 with Brotli 1.2.0 that stream content with the streaming API (`preload_content=False`).

While no explicit commands are provided in the resources, general approaches include:

• Checking the version of urllib3 and Brotli installed, for example using Python commands:
• ```python import urllib3 import brotli print(urllib3.__version__) print(brotli.__version__) ```
• Monitoring application logs and system metrics for high memory consumption or crashes during HTTP streaming operations.
• Using network monitoring tools to detect unusually large decompressed payloads from untrusted HTTP servers.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading urllib3 to a version that contains the fix for CVE-2026-9375.

The fix involves changes to the `drain_conn` and `read` methods to properly enforce decompression safeguards and prevent memory exhaustion.

If upgrading is not immediately possible, consider disabling Brotli decompression or avoiding streaming responses with `preload_content=False` when using vulnerable versions.

Additionally, monitor and limit memory usage for applications that handle untrusted HTTP content to reduce the risk of denial-of-service.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0