Listen to this Post
The vulnerability exists in the interaction between urllib3’s streaming API (preload_content=False) and HTTP redirect responses. The library’s design efficiently handles compressed data (gzip, deflate, br, zstd) in chunks during normal streaming. However, for HTTP 3xx redirect responses, the library’s connection-draining logic had a flaw. Before passing control to the user’s stream-reading code, it would automatically and fully read the entire response body from the connection to prepare it for reuse. This draining process unconditionally decompressed the entire body content, regardless of the `preload_content=False` setting or any configured read limits (like max_bytes). This created a mismatch: the streaming API’s safety limits were bypassed during this mandatory drain. A malicious server could respond to a request with a redirect containing a small, highly compressed payload (a decompression bomb). When urllib3 automatically followed the redirect, it would decompress the entire bomb into memory, leading to massive, uncontrolled memory allocation and high CPU consumption, effectively causing a Denial-of-Service on the client.
DailyCVE Form:
Platform: Python urllib3
Version: <=2.6.2
Vulnerability: Redirect Decompression Bomb
Severity: Critical
Date: 2024-07-15
Prediction: Patched 2024-07-15
What Undercode Say:
pip list | grep urllib3
import urllib3
http = urllib3.PoolManager()
response = http.request('GET', 'http://malicious.example/redirect_bomb', preload_content=False, redirect=True) Vulnerable call
pip install 'urllib3>=2.6.3'
How Exploit:
1. Attacker hosts malicious server.
2. Server responds with 302/301 redirect.
3. Redirect response has `Content-Encoding: gzip`.
4. Response body is a tiny compressed bomb.
5. Client’s urllib3 automatically drains/decompresses bomb.
Protection from this CVE
Upgrade to >=2.6.3.
Disable redirects (`redirect=False`).
Use trusted sources.
Impact:
Client-side resource exhaustion.
Denial-of-Service.
High CPU/Memory usage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
