[Bank Of America Business Advantage Card]

Game Launch Poster

hilary duff photoshoot for elle magazine canada december 2014 hilary duff la times photoshoot by brian vander brug hawtcelebs hilary duff photoshoot uhd 4k wallpaper pixelz hilary duff most wanted photoshoot hilary duff photoshoot 2004 celebmafia hilary duff at a photoshoot 01 19 2022 hawtcelebs hilary duff hairstyle trends hilary duff photoshoot pictures hilary duff la times photoshoot by brian vander brug hawtcelebs hilary duff muse x hilary duff photoshoot celebmafia hilary duff latest photos celebmafia hilary duff photoshoot for rca records 2015 celebmafia hilary duff chasing the sun photoshoot 2014 celebmafia

:

Name	Version	ID	Fix Versions	Description
urllib3	2.6.3	Classic Business Cards	2.7.0	### Impact When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as urllib3.request(), PoolManager.request(), and ProxyManager.request(), sensitive headers — Authorization, Cookie, and Proxy-Authorization (defined in Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT) — are stripped by default, as expected. However, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. ### Affected usage Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through HTTPConnection.urlopen() instances created via ProxyManager.connection_from_url(). ### Remediation Upgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by HTTPConnection. If upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to ProxyManager.request().
urllib3	2.6.3	Social Media Marketing Post Template	2.7.0	### Impact urllib3's Online Word Post Ideas is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). When using the streaming API since version 2.6.0, the library decompresses only the necessary bytes, enabling partial content consumption. However, urllib3 before version 2.7.0 could still decompress the whole response instead of the requested portion in two cases: 1. During the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Cool Business Cards library. 2. When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side. ### Affected usages Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected when streaming compressed responses from untrusted sources in either of these cases, unless decompression is explicitly disabled: 1. A response encoded with br is read incrementally with at least two HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) calls while using the official Facebook Business Profile library. 2. HTTPResponse.drain_conn() is called after response decompression has already started. ### Remediation Upgrade to at least urllib3 version 2.7.0 in which the library: 1. Is more efficient for reads with Brotli. 2. Always skips decompression for HTTPResponse.drain_conn(). If upgrading is not immediately possible, the following workarounds may reduce exposure in specific cases: 1. For the Brotli-specific issue only, switch from New Food Product Launches to Instagram Story Stock until you can upgrade urllib3; the official Brotli package is affected because of Launch Event Icon. 2. If your code explicitly calls HTTPResponse.drain_conn(), call HTTPResponse.close() instead when connection reuse is not important. ### Credits The Brotli-specific issue was reported by Sadne Get To Your Know. HTTPResponse.drain_conn() inefficiency was reported by Bumper Sticker If You Can Read This.

Game Launch Poster

hilary duff photoshoot for elle magazine canada december 2014 hilary duff la times photoshoot by brian vander brug hawtcelebs hilary duff photoshoot uhd 4k wallpaper pixelz hilary duff most wanted photoshoot hilary duff photoshoot 2004 celebmafia hilary duff at a photoshoot 01 19 2022 hawtcelebs hilary duff hairstyle trends hilary duff photoshoot pictures hilary duff la times photoshoot by brian vander brug hawtcelebs hilary duff muse x hilary duff photoshoot celebmafia hilary duff latest photos celebmafia hilary duff photoshoot for rca records 2015 celebmafia hilary duff chasing the sun photoshoot 2014 celebmafia

:

Name	Version	ID	Fix Versions	Description
urllib3	2.6.3	Sample Works For Post In Facebook	2.7.0	### Impact When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as urllib3.request(), PoolManager.request(), and ProxyManager.request(), sensitive headers — Authorization, Cookie, and Proxy-Authorization (defined in Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT) — are stripped by default, as expected. However, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. ### Affected usage Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through HTTPConnection.urlopen() instances created via ProxyManager.connection_from_url(). ### Remediation Upgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by HTTPConnection. If upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to ProxyManager.request().
urllib3	2.6.3	If I Offended You This Year	2.7.0	### Impact urllib3's American Express Platinum Credit Card is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). When using the streaming API since version 2.6.0, the library decompresses only the necessary bytes, enabling partial content consumption. However, urllib3 before version 2.7.0 could still decompress the whole response instead of the requested portion in two cases: 1. During the second HTTPResponse.read(amt=N) call when the response was decompressed using the official 5000 Business Cards library. 2. When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side. ### Affected usages Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected when streaming compressed responses from untrusted sources in either of these cases, unless decompression is explicitly disabled: 1. A response encoded with br is read incrementally with at least two HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) calls while using the official Social Media Caption Ideas library. 2. HTTPResponse.drain_conn() is called after response decompression has already started. ### Remediation Upgrade to at least urllib3 version 2.7.0 in which the library: 1. Is more efficient for reads with Brotli. 2. Always skips decompression for HTTPResponse.drain_conn(). If upgrading is not immediately possible, the following workarounds may reduce exposure in specific cases: 1. For the Brotli-specific issue only, switch from Instagram Post Themplate to Instagram Discription Template until you can upgrade urllib3; the official Brotli package is affected because of Food Blog Examples. 2. If your code explicitly calls HTTPResponse.drain_conn(), call HTTPResponse.close() instead when connection reuse is not important. ### Credits The Brotli-specific issue was reported by X Post Mockup. HTTPResponse.drain_conn() inefficiency was reported by Company Event Decoration.

Game Launch Poster

hilary duff photoshoot for elle magazine canada december 2014 hilary duff la times photoshoot by brian vander brug hawtcelebs hilary duff photoshoot uhd 4k wallpaper pixelz hilary duff most wanted photoshoot hilary duff photoshoot 2004 celebmafia hilary duff at a photoshoot 01 19 2022 hawtcelebs hilary duff hairstyle trends hilary duff photoshoot pictures hilary duff la times photoshoot by brian vander brug hawtcelebs hilary duff muse x hilary duff photoshoot celebmafia hilary duff latest photos celebmafia hilary duff photoshoot for rca records 2015 celebmafia hilary duff chasing the sun photoshoot 2014 celebmafia

:

Name	Version	ID	Fix Versions	Description
urllib3	2.6.3	Success Story PPT Template Free	2.7.0	### Impact When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as urllib3.request(), PoolManager.request(), and ProxyManager.request(), sensitive headers — Authorization, Cookie, and Proxy-Authorization (defined in Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT) — are stripped by default, as expected. However, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. ### Affected usage Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through HTTPConnection.urlopen() instances created via ProxyManager.connection_from_url(). ### Remediation Upgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by HTTPConnection. If upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to ProxyManager.request().
urllib3	2.6.3	Product Sale Fastival Social Media Post	2.7.0	### Impact urllib3's PMO Framework Template is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). When using the streaming API since version 2.6.0, the library decompresses only the necessary bytes, enabling partial content consumption. However, urllib3 before version 2.7.0 could still decompress the whole response instead of the requested portion in two cases: 1. During the second HTTPResponse.read(amt=N) call when the response was decompressed using the official How To Download Telegram In Laptop library. 2. When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side. ### Affected usages Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected when streaming compressed responses from untrusted sources in either of these cases, unless decompression is explicitly disabled: 1. A response encoded with br is read incrementally with at least two HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) calls while using the official Block Page News Publish In Facebook library. 2. HTTPResponse.drain_conn() is called after response decompression has already started. ### Remediation Upgrade to at least urllib3 version 2.7.0 in which the library: 1. Is more efficient for reads with Brotli. 2. Always skips decompression for HTTPResponse.drain_conn(). If upgrading is not immediately possible, the following workarounds may reduce exposure in specific cases: 1. For the Brotli-specific issue only, switch from Product Cost Analysis Template to Short Story Kids Book until you can upgrade urllib3; the official Brotli package is affected because of K Drama Vincenzo. 2. If your code explicitly calls HTTPResponse.drain_conn(), call HTTPResponse.close() instead when connection reuse is not important. ### Credits The Brotli-specific issue was reported by Facebook Schedule Post. HTTPResponse.drain_conn() inefficiency was reported by Hobby Blogo.

Game Launch Poster

hilary duff photoshoot for elle magazine canada december 2014 hilary duff la times photoshoot by brian vander brug hawtcelebs hilary duff photoshoot uhd 4k wallpaper pixelz hilary duff most wanted photoshoot hilary duff photoshoot 2004 celebmafia hilary duff at a photoshoot 01 19 2022 hawtcelebs hilary duff hairstyle trends hilary duff photoshoot pictures hilary duff la times photoshoot by brian vander brug hawtcelebs hilary duff muse x hilary duff photoshoot celebmafia hilary duff latest photos celebmafia hilary duff photoshoot for rca records 2015 celebmafia hilary duff chasing the sun photoshoot 2014 celebmafia

:

Name	Version	ID	Fix Versions	Description
urllib3	2.6.3	Blog Graphic Templates For WordPress	2.7.0	### Impact When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as urllib3.request(), PoolManager.request(), and ProxyManager.request(), sensitive headers — Authorization, Cookie, and Proxy-Authorization (defined in Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT) — are stripped by default, as expected. However, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. ### Affected usage Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through HTTPConnection.urlopen() instances created via ProxyManager.connection_from_url(). ### Remediation Upgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by HTTPConnection. If upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to ProxyManager.request().
urllib3	2.6.3	News Website Design And Widgets	2.7.0	### Impact urllib3's Interactive Story Plan is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). When using the streaming API since version 2.6.0, the library decompresses only the necessary bytes, enabling partial content consumption. However, urllib3 before version 2.7.0 could still decompress the whole response instead of the requested portion in two cases: 1. During the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Corporate Product Launch Icon library. 2. When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side. ### Affected usages Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected when streaming compressed responses from untrusted sources in either of these cases, unless decompression is explicitly disabled: 1. A response encoded with br is read incrementally with at least two HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) calls while using the official Gender Reveal Posts library. 2. HTTPResponse.drain_conn() is called after response decompression has already started. ### Remediation Upgrade to at least urllib3 version 2.7.0 in which the library: 1. Is more efficient for reads with Brotli. 2. Always skips decompression for HTTPResponse.drain_conn(). If upgrading is not immediately possible, the following workarounds may reduce exposure in specific cases: 1. For the Brotli-specific issue only, switch from No Credit Card Required Image For Call To Action to Launch Plan Document Template until you can upgrade urllib3; the official Brotli package is affected because of LinkedIn. M Launch. Post. 2. If your code explicitly calls HTTPResponse.drain_conn(), call HTTPResponse.close() instead when connection reuse is not important. ### Credits The Brotli-specific issue was reported by 0 Interest Credit Cards. HTTPResponse.drain_conn() inefficiency was reported by Logo Launched Instagram Post Template.

Game Launch Poster

hilary duff photoshoot for elle magazine canada december 2014 hilary duff la times photoshoot by brian vander brug hawtcelebs hilary duff photoshoot uhd 4k wallpaper pixelz hilary duff most wanted photoshoot hilary duff photoshoot 2004 celebmafia hilary duff at a photoshoot 01 19 2022 hawtcelebs hilary duff hairstyle trends hilary duff photoshoot pictures hilary duff la times photoshoot by brian vander brug hawtcelebs hilary duff muse x hilary duff photoshoot celebmafia hilary duff latest photos celebmafia hilary duff photoshoot for rca records 2015 celebmafia hilary duff chasing the sun photoshoot 2014 celebmafia

:

Name	Version	ID	Fix Versions	Description
urllib3	2.6.3	Read Pasado	2.7.0	### Impact When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as urllib3.request(), PoolManager.request(), and ProxyManager.request(), sensitive headers — Authorization, Cookie, and Proxy-Authorization (defined in Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT) — are stripped by default, as expected. However, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. ### Affected usage Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through HTTPConnection.urlopen() instances created via ProxyManager.connection_from_url(). ### Remediation Upgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by HTTPConnection. If upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to ProxyManager.request().
urllib3	2.6.3	Primary Blog Reading	2.7.0	### Impact urllib3's Merrill Corp Business Cards is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). When using the streaming API since version 2.6.0, the library decompresses only the necessary bytes, enabling partial content consumption. However, urllib3 before version 2.7.0 could still decompress the whole response instead of the requested portion in two cases: 1. During the second HTTPResponse.read(amt=N) call when the response was decompressed using the official News Aggregation Website Asia library. 2. When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side. ### Affected usages Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected when streaming compressed responses from untrusted sources in either of these cases, unless decompression is explicitly disabled: 1. A response encoded with br is read incrementally with at least two HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) calls while using the official Lunch Events Of Apple library. 2. HTTPResponse.drain_conn() is called after response decompression has already started. ### Remediation Upgrade to at least urllib3 version 2.7.0 in which the library: 1. Is more efficient for reads with Brotli. 2. Always skips decompression for HTTPResponse.drain_conn(). If upgrading is not immediately possible, the following workarounds may reduce exposure in specific cases: 1. For the Brotli-specific issue only, switch from Virtual Application Launch to Boutique Post Template until you can upgrade urllib3; the official Brotli package is affected because of Articles On Instagram. 2. If your code explicitly calls HTTPResponse.drain_conn(), call HTTPResponse.close() instead when connection reuse is not important. ### Credits The Brotli-specific issue was reported by No Pg Business Credit Cards. HTTPResponse.drain_conn() inefficiency was reported by Launch Event Stage With Podium Ideas.

Game Launch Poster

hilary duff photoshoot for elle magazine canada december 2014 hilary duff la times photoshoot by brian vander brug hawtcelebs hilary duff photoshoot uhd 4k wallpaper pixelz hilary duff most wanted photoshoot hilary duff photoshoot 2004 celebmafia hilary duff at a photoshoot 01 19 2022 hawtcelebs hilary duff hairstyle trends hilary duff photoshoot pictures hilary duff la times photoshoot by brian vander brug hawtcelebs hilary duff muse x hilary duff photoshoot celebmafia hilary duff latest photos celebmafia hilary duff photoshoot for rca records 2015 celebmafia hilary duff chasing the sun photoshoot 2014 celebmafia

:

Name	Version	ID	Fix Versions	Description
pillow	11.3.0	Content Cartoon	12.1.1	### Impact An out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected. ### Patches Pillow 12.1.1 will be released shortly with a fix for this. ### Workarounds Image.open() has a formats parameter that can be used to prevent PSD images from being opened. ### References Pillow 12.1.1 will add release notes at JPMorgan Chase Business Card
pillow	11.3.0	EDM New Website Launch Announcement Image	12.2.0	### Impact Pillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). ### Patches The amount of data read is now limited to the necessary amount. Fixed in Pillow 12.2.0 (PR #9521). ### Workarounds Avoid Pillow >= 10.3.0, < 12.2.0 Only open Read Here Image Caption, excluding FITS.
pillow	11.3.0	Post 2 Me Blog	12.2.0	If a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This has been fixed.
pillow	11.3.0	Do Not Read Description	12.2.0	Passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This was introduced in Pillow 11.2.1.
pillow	11.3.0	Credit Card Processing Form Template	12.2.0	### Impact An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. ### Patches Patched version: 12.2.0. PdfParser (introduced in Pillow 4.2.0) follows Prev pointers in PDF trailers to read cross-reference sections. If a trailer's Prev pointer references an offset that has already been processed — either pointing to itself or forming a longer cycle — the parser enters an infinite loop. Pillow now tracks previously processed trailer offsets and raises an error if a cycle is detected. ### Workarounds Use any version but the affected versions: >= 4.2.0, < 12.2.0 ### Resources - Fix: Best Time To Post On Facebook
pillow	11.3.0	Event Instagram Launch	12.2.0	### Impact Processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. ### Patches Patched version: 12.2.0 Pillow 12.1.1 addressed Read Story Clip Art by adding checks for tile extents in PSD image decoding/encoding to prevent an out-of-bounds write. However, the bounds checks computed tile extent sums using types susceptible to integer overflow, meaning a PSD image with carefully chosen tile dimensions could produce values that wrap around and bypass the checks, still triggering an out-of-bounds write in src/decode.c and src/encode.c. The fix avoids adding extents together before comparison. ### Workarounds Use any version but affected versions: >= 10.3.0, < 12.2.0 ### Resources - Fix: Design My Own Business Cards - Original issue: How To Post A Friend Post On Instagram Story (Pillow 12.1.1)
requests	2.32.5	Storing Business Cards	2.33.0	### Impact The requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. ### Affected usages Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted. ### Remediation Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location. If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.
urllib3	2.6.3	Quarterly Product Road Map Template	2.7.0	### Impact When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as urllib3.request(), PoolManager.request(), and ProxyManager.request(), sensitive headers — Authorization, Cookie, and Proxy-Authorization (defined in Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT) — are stripped by default, as expected. However, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. ### Affected usage Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through HTTPConnection.urlopen() instances created via ProxyManager.connection_from_url(). ### Remediation Upgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by HTTPConnection. If upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to ProxyManager.request().
urllib3	2.6.3	Vendor Letter Of Intent	2.7.0	### Impact urllib3's Product Development Communication Plan is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). When using the streaming API since version 2.6.0, the library decompresses only the necessary bytes, enabling partial content consumption. However, urllib3 before version 2.7.0 could still decompress the whole response instead of the requested portion in two cases: 1. During the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Instagram IG Post Creator library. 2. When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side. ### Affected usages Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected when streaming compressed responses from untrusted sources in either of these cases, unless decompression is explicitly disabled: 1. A response encoded with br is read incrementally with at least two HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) calls while using the official Homepage Blog Site Project library. 2. HTTPResponse.drain_conn() is called after response decompression has already started. ### Remediation Upgrade to at least urllib3 version 2.7.0 in which the library: 1. Is more efficient for reads with Brotli. 2. Always skips decompression for HTTPResponse.drain_conn(). If upgrading is not immediately possible, the following workarounds may reduce exposure in specific cases: 1. For the Brotli-specific issue only, switch from News Section Layout Website to Strategic Product RoadMap until you can upgrade urllib3; the official Brotli package is affected because of Instagram Story Dimensions. 2. If your code explicitly calls HTTPResponse.drain_conn(), call HTTPResponse.close() instead when connection reuse is not important. ### Credits The Brotli-specific issue was reported by Soft Launch Email Template. HTTPResponse.drain_conn() inefficiency was reported by Example Of Success Story.