Summary
urllib3: Chunked Deflate streaming can enter an infinite loop
Affected usages
Applications and libraries using urllib3 versions 2.6.2 through 2.7.0 may be affected when all of the following conditions are met:
- Compressed responses from an untrusted source are streamed using
HTTPResponse.stream(amt=N)orHTTPResponse.read_chunked(amt=N)with a positive, finite chunk size. - Content decoding is enabled.
- The response uses both
Transfer-Encoding: chunkedandContent-Encoding: deflate. - The decoded body exceeds the requested chunk size and the encoded body contains bytes after the end of the Deflate stream.
HTTPResponse.stream() uses a finite chunk size by default and is therefore affected when the other conditions are met.
Impact
urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading content in chunks instead of loading the entire response body into memory at once.
urllib3 can decompress response bodies according to the HTTP Content-Encoding header. When streaming a compressed, chunked response, urllib3 first consumes data already buffered by the decoder before reading the next HTTP chunk.
However, urllib3 versions from 2.6.2 through 2.7.0 could enter an infinite loop when a chunked response contained bytes after the end of the Deflate stream. If the decompressed body exceeded the requested streaming chunk size, Python's zlib implementation could retain the trailing bytes as unconsumed input after reaching the end of the compressed stream. urllib3 would repeatedly attempt to decode those same bytes without making progress or reading more data from the network.
A malicious server could exploit this behavior to cause excessive CPU usage and prevent the affected request from completing on the client. Network read timeouts would not interrupt the loop because no further socket operation was required.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Upgrade to urllib3 2.8.0, in which the Deflate decoder stops accepting input after reaching the end of the compressed stream and no longer reports trailing bytes as data that can produce more decoded output.
If upgrading is not immediately possible, disable automatic content decoding for responses from untrusted sources by setting decode_content=False, or reject streamed responses using the Deflate content encoding. Applications that disable automatic decoding must handle the compressed response safely at another layer.
Frequently Asked Questions
- What is CVE-2026-97688? CVE-2026-97688 is a medium-severity security vulnerability in urllib3 (pip), affecting versions >= 2.6.2, < 2.8.0. It is fixed in 2.8.0.
- Which versions of urllib3 are affected by CVE-2026-97688? urllib3 (pip) versions >= 2.6.2, < 2.8.0 is affected.
- Is there a fix for CVE-2026-97688? Yes. CVE-2026-97688 is fixed in 2.8.0. Upgrade to this version or later.
- Is CVE-2026-97688 exploitable, and should I be worried? Whether CVE-2026-97688 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-97688 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-97688? Upgrade
urllib3to 2.8.0 or later.