Search/CVE-2025-66471
● CVE — High

CVE-2025-66471

VendorpythonProducturllib3DiscoveredDec 5, 2025UpdatedSep 25, 2026

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to…

CVSS v3.1
7.5 HIGH
EPSS
0.68%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
3
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Sep 1, 2026
▼ 0.01pp
0.69% → 0.68% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityNONE
IntegrityNONE
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Connections
5 relationships
Timeline
disclosure → media coverage
Dec 5, 2025
Disclosure — published as a CVE record. · last revised by NVD Sep 25, 2026
Dec 11, 2025
ubuntu.com reports: USN-7927-1: urllib3 vulnerabilities
Jan 13, 2026
ubuntu.com reports: USN-7927-3: urllib3 regression
May 28, 2026
ubuntu.com reports: USN-8344-1: pip vulnerabilities