CVE-2026-21441

score

<0.1

cvss

7.5

epss

2.9%

published

2026-01-07

kev added

—

first seen

2026-10-21

urllib3 1.22 to < 2.6.3 contains a resource exhaustion vulnerability caused by decompression of entire HTTP redirect response bodies even when streaming, letting attackers trigger excessive resource consumption, exploit requires streaming content with redirects enabled.