CVE-2026-97688 · GHSA-gh4c-6fx4-qh6g
urllib3: Chunked Deflate streaming can enter an infinite loop
- Risk score
- 46/100
- CVSS
- 5.3 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an u…
- Affected
- urllib3 (pip) >= 2.6.2, < 2.8.0
- Fix
- Upgrade urllib3 to 2.8.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
urllib3: Amber, patch this week. urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectl…
The flaws
- CVE-2026-97688: Chunked Deflate streaming can enter an infinite loop (CVSS 5.3 · EPSS 0%)
- CVE-2026-97687: HTTPS proxy TLS configuration may be ignored or overridden (CVSS 8.1 · EPSS 0%)
- CVE-2026-97689: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory (CVSS 7.5 · EPSS 0%)
The fix
Upgrade urllib3: 2.8.0 or later on your release line
Who is exposed: urllib3 (pip) >= 1.26.0, < 2.8.0
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-835 (CWE-835). 53 other warnings in 30 days
Why it is Yellow
- CVSS 5.3 medium
- On your watchlist: python, PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| urllib3 | pip | >= 2.6.2, < 2.8.0 | 2.8.0 |
References
- https://github.com/advisories/GHSA-gh4c-6fx4-qh6g
- https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g
- https://nvd.nist.gov/vuln/detail/CVE-2026-97688
- https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f
- https://github.com/urllib3/urllib3/releases/tag/2.8.0
- https://github.com/advisories/GHSA-gh4c-6fx4-qh6g
Original description
urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0.
Last activity 29 Sep 2026. Patch Forecast updates every hour.