CVE-2026-21441

A flaw was found in urllib3. When processing HTTP redirect responses during data streaming, the library automatically reads and decompresses the full response body without enforcing configured size limits. A malicious server can exploit this by serving an excessively compressed response, bypassing decompression bomb safeguards. This issue leads to high memory and processor consumption, resulting in a Denial of Service (DoS) on the client.

Red Hat has rated this vulnerability as Important because an untrusted remote server can trigger severe CPU consumption and memory exhaustion on the client, leading to a denial of service without requiring authentication. This issue specifically affects scenarios where client applications stream content from untrusted endpoints while automatic redirect handling remains active, as redirect responses are uncompressed without enforcing stream limits. Environments that communicate only with trusted endpoints or configure requests to prevent automatic redirection are not susceptible to this attack vector.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.