Listen to this Post
How the CVE Works:
The vulnerability exists in urllib3’s HTTP response content decoding. According to RFC 9110, a server can specify multiple, chained content encodings in the `Content-Encoding` header (e.g., gzip, zstd, gzip). urllib3 would recursively decompress the response data for each encoding in the chain. The library did not limit the number of allowed encoding steps. A malicious server could craft a response with an extremely long chain of encodings (e.g., 1000 layers of gzip). For each step in the chain, urllib3 would allocate memory for the decompressed data from the previous step, leading to exponential memory growth and sustained high CPU consumption during the recursive decompression process, ultimately causing a denial-of-service on the client system.
Platform: urllib3 (Python)
Version: <= 2.5.0
Vulnerability: Unbounded decompression chain
Severity: High
date: 2023-10-25
Prediction: 2023-10-25
What Undercode Say:
`pip show urllib3`
`python -c “import urllib3; print(urllib3.__version__)”`
`curl -H “Content-Encoding: gzip, gzip, gzip, gzip, gzip, gzip” http://test.local`
import urllib3
http = urllib3.PoolManager()
resp = http.request('GET', 'http://malicious.server/', preload_content=False) Workaround
encodings = resp.headers.get('content-encoding', '').split(',')
if len(encodings) <= 5:
data = resp.read()
How Exploit:
Malicious server responds with a `Content-Encoding` header containing hundreds of compression algorithms (e.g., `gzip, deflate` repeated). Client’s urllib3 naively enters a deep, recursive decompression loop, allocating massive buffers for each iteration until system memory/CPU is exhausted.
Protection from this CVE
Upgrade to urllib3>=2.6.0. Use `preload_content=False` and validate `content-encoding` header count before reading response body. Implement HTTP client timeouts.
Impact:
Resource Exhaustion (DoS). Memory consumption amplification. CPU utilization spike.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
