-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability described as 'urllib3 allows an unbounded number of links in the decompression chain' is directly addressed in the provided patch. The commit 24d7b67eac89f94e11003424bcf0d8f7b72222a8 modifies the src/urllib3/response.py file, specifically within the MultiDecoder class. The __init__ method of this class is where the Content-Encoding header is processed. The patch explicitly adds a check to limit the number of chained encodings to 5. This indicates that the urllib3.response.MultiDecoder.__init__ function was the point of vulnerability, as it previously processed an unlimited number of encodings, leading to potential resource exhaustion. The HTTPResponse class uses MultiDecoder to handle responses with multiple content encodings, making the __init__ method of MultiDecoder the primary vulnerable function.
urllib3.response.MultiDecoder.__init__src/urllib3/response.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| urllib3 | pip | >= 1.24, < 2.6.0 | 2.6.0 |