What is CVE-2025-66471?

CVE-2025-66471 is a high-severity vulnerability in Python Urllib3, classified under Improper Handling of Highly Compressed Data (Data Amplification). CVSS score: 7.5/10. Published 2025-12-05.

How severe is CVE-2025-66471?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Python Urllib3

CVE-2025-66471

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTT…

EPSS: 0.006 (46.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Python Urllib3
Urllib3 — versions >= 1.0, < 2.6.0

Weakness classification (CWE)

CWE-409 — Improper Handling of Highly Compressed Data (Data Amplification)

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-66471?: CVE-2025-66471 is a high-severity vulnerability in Python Urllib3, classified under Improper Handling of Highly Compressed Data (Data Amplification). CVSS score: 7.5/10. Published 2025-12-05.
How severe is CVE-2025-66471?: High severity. CVSS v3 base score is 7.5 out of 10.