DocumentationSeverity
8.9
High severity
Details
- CVSS score
- 8.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Overview
About vulnerability
urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.Details
- Affected product:
- Debian 11 ELS , FastAPI , Requests , Ubuntu 18.04 ELS , aiobotocore , airflow , apache-airflow-providers-http , azure-core , boto3 , botocore , cachecontrol , cadwyn , dash , databricks-cli , databricks-sdk , docker , dulwich , google-api-core , google-auth , google-auth-httplib2 , google-cloud-compute , google-cloud-core , google-cloud-pubsub , google-cloud-storage , huggingface_hub , langchain-core , langchain-text-splitters , langgraph-checkpoint , langsmith-sdk , mlflow , opentelemetry-python , poetry , poetry-plugin-export , s3transfer , sentence-transformers , sentry-sdk , tokenizers , torchvision , transformers , ultralytics , urllib3
- Affected packages:
- urllib3 @ 1.25.11 (+141 more)