CVE-2026-97689 · GHSA-vxq7-64xx-v4gw

urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

Risk score: 65/100
CVSS: 7.5 v3.1
Exploit chance (30 days): 0.3%
Published: 29 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns …
Affected: urllib3 (pip) >= 1.10.3, < 2.8.0
Fix: Upgrade urllib3 to 2.8.0 or later.
Exploitation: No known exploitation

Why it is Amber

CVSS 7.5 high
Remotely exploitable without logging in
On your watchlist: python, PyPI

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
urllib3	pip	>= 1.10.3, < 2.8.0	2.8.0

References

Original description

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.

Last activity 29 Sep 2026. Patch Forecast updates every hour.