ALPINE-CVE-2025-66418

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2025-66418
Published: 05 Dec 2025, 16:15
Last modified:23 Jan 2026, 23:30

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
3.1 (osv_alpine)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

05 Dec 2025, 16:15
Published
Vulnerability first disclosed
23 Jan 2026, 23:30
Last Modified
Vulnerability information updated

Description

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Systems

  • alpine•py3-urllib3

    < 2.6.3-r0

References (1)