Impact
urllib3 versions affected by CVE-2026-21441 can bypass streaming decompression-bomb safeguards when handling HTTP redirect responses [S1][S2]. In affected releases, redirect response draining could decode a compressed response before application reads apply [S1][S2]. A malicious server could trigger excessive client CPU or memory use when an application streams from untrusted sources with redirects enabled [S1][S2].
Root Cause
The issue is in redirect handling for urllib3's streaming API. Starting in 1.22 and before 2.6.3, urllib3 could drain a redirect response and decompress content even though callers expected streaming reads [S1][S2]. The advisory condition depends on runtime usage: a dependency match does not prove deployed code sets preload_content=False, follows redirects for untrusted sources, or is resource-exhaustible.
Affected Versions
- urllib3 versions from 1.22 through 2.6.2 [S1][S3]
Fixes
Upgrade urllib3 to 2.6.3 or newer [S1][S2]. Regenerate active lockfiles and rebuild servers, workers, CLI jobs, notebooks, containers, and CI caches. Review code that streams content from untrusted URLs, especially uses of preload_content=False with redirects enabled. If an immediate upgrade is blocked, disable redirects for untrusted sources while rollout completes [S1][S2].
Covered by FixVibe
FixVibe's GitHub repo scans flag Python dependency manifests and lockfiles that resolve urllib3 versions in the affected range [S1][S3], with the file, version, advisory IDs and fixed version.