USN-7927-1: urllib3 vulnerabilities

USN-7927-1: urllib3 vulnerabilities

Publication date: 11 December 2025
Overview: Several security issues were fixed in urllib3.

Packages
python-urllib3 - HTTP library with thread-safe connection pooling

Details
Illia Volochii discovered that urllib3 did not limit the steps in a
decompression chain. An attacker could possibly use this issue to cause
urllib3 to use excessive resources, causing a denial of service.
(CVE-2025-66418)

Rui Xi discovered that urllib3 incorrectly handled highly compressed data.
An attacker could possibly use this issue to cause urllib3 to use excessive
resources, causing a denial of service. This issue only affected Ubuntu
24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-66471)

For the brotli encoding, the fix for CVE-2025-66471 requires an additional
security update in the brotli package.

Update instructions
In general, a standard system update will make all the necessary changes.

The problem can be corrected by updating your system to the following package versions:

• 25.10 questing python3-urllib3 – 2.3.0-3ubuntu0.1
• 25.04 plucky python3-urllib3 – 2.3.0-2ubuntu0.2
• 24.04 LTS noble python3-urllib3 – 2.0.7-1ubuntu0.3
• 22.04 LTS jammy python3-urllib3 – 1.26.5-1~exp1ubuntu0.4
• 20.04 LTS focal python3-urllib3 – 1.25.8-2ubuntu0.4+esm2