🔒 Security: Fix CVE-2025-66471 by upgrading urllib3 to 2.6.2 #170
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Ignore environment files (.envrc, development.env, production.env) - Ignore database dumps (*.dump, *.duckdb) - Ignore local settings (pythonie/pythonie/settings/pgdev.py) - Ignore MinIO data directory (mc/) - Ignore personal notes (TODO.md)
Upgrade urllib3 from 2.5.0 to 2.6.2 to address CVE-2025-66471 (GHSA-2xpw-w6gg-jr37), a high-severity vulnerability related to improper handling of highly compressed data in the streaming API. This vulnerability could lead to excessive CPU and memory consumption when processing highly compressed responses from untrusted sources, potentially causing denial of service. Fixes: #120 Severity: High (CVSS v4: 8.9) CWE-409: Improper Handling of Highly Compressed Data
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🔒 Security Fix
This PR addresses Dependabot security alert #120 by upgrading
urllib3from version 2.5.0 to 2.6.2.Vulnerability Details
Impact
The urllib3 streaming API improperly handles highly compressed data. When streaming a compressed HTTP response, urllib3 could decompress a small amount of highly compressed data in a single operation, leading to:
Applications using urllib3's streaming methods (
stream(),read(),read1(),read_chunked(),readinto()) to handle compressed responses from untrusted sources were vulnerable.Fix
Upgraded urllib3 to version 2.6.2, which includes proper limits to prevent decompressing data that exceeds the requested amount.
Files Changed
requirements/dev.txt- urllib3: 2.5.0 → 2.6.2requirements/main.txt- urllib3: 2.5.0 → 2.6.2requirements/production.txt- Added typing-extensions dependencyReferences
Closes #120