CVE-2026-21441

CVE-2026-21441 is a denial-of-service vulnerability affecting urllib3 versions 1.22 through 2.6.2. It arises from the library unnecessarily decompressing entire redirect response bodies, even when streaming is enabled, allowing a malicious server to trigger excessive resource consumption via a decompression bomb. This vulnerability has a CVSS score of 7.5 (High), indicating a network-based attack with low complexity and high impact on availability. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered significant community discussion, with multiple mentions on GitHub and Bluesky regarding fixes and updates.