-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| urllib3 | pip | >= 1.0, < 2.6.0 | 2.6.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists because the streaming API in urllib3 did not limit the amount of data produced during the decompression of HTTP response bodies. An attacker could craft a highly compressed payload (a 'decompression bomb') that, when processed, would consume an excessive amount of memory and CPU resources on the client, even if the client application only requested a small portion of the data. The root cause was that the decompress methods within the various decoder classes (GzipDecoder, DeflateDecoder, etc.) would decompress as much data as was available in their input buffers, without respect to the amount of data the user actually requested from the stream.
The patch addresses this by introducing a max_length parameter to the decompress methods of all content decoders. This parameter is then used by the user-facing read methods (read, read1, stream, read_chunked) to signal to the decoders the maximum amount of decompressed data that should be produced. This prevents the library from decompressing the entire malicious payload at once, thus mitigating the resource exhaustion attack.
DeflateDecoder.decompresssrc/urllib3/response.py
GzipDecoder.decompresssrc/urllib3/response.py
BrotliDecoder.decompresssrc/urllib3/response.py
ZstdDecoder.decompresssrc/urllib3/response.py
HTTPResponse.readsrc/urllib3/response.py
HTTPResponse.streamsrc/urllib3/response.py
HTTPResponse.read_chunkedsrc/urllib3/response.py
A Semantic Attack on Google Gemini - Read the Latest Research