Listen to this Post
How the CVE Works:
The vulnerability exists in urllib3’s streaming API for compressed HTTP responses (e.g., gzip, Brotli). When an application requests a small chunk (e.g., 256 bytes) from a stream, the underlying decompression decoder (like brotli.Decompressor) may be forced to fully inflate a highly compressed data block in one operation to honor the read request. This causes a significant mismatch: a tiny compressed payload can decompress into gigabytes of data. The library’s buffering logic then attempts to hold this massive, unsolicited output in memory for the next read, leading to immediate and excessive memory allocation and CPU consumption on the client system, constituting a Denial-of-Service.
Platform: urllib3 (Python)
Version: <= 2.5.0
Vulnerability : Resource Consumption DoS
Severity: Critical
date: 2024-08-27
Prediction: 2024-08-27 (Patched in v2.6.0)
What Undercode Say:
`$ pip show urllib3`
`$ python -c “import urllib3; print(urllib3.__version__)”`
`$ pip install ‘urllib3>=2.6.0’`
How Exploit:
An attacker controls an HTTP server responding with a small, highly compressed Brotli or gzip payload. A victim client using a vulnerable urllib3 method like `read(amt=128)` triggers full decompression into memory.
Protection from this CVE:
Upgrade to urllib3 >=2.6.0. Disable response decompression (auto_decompress=False) if streaming from untrusted sources. Ensure brotli/brotlicffi >=1.2.0.
Impact:
Denial-of-Service via memory exhaustion and high CPU load on the client.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
