CVE-2026-9375 is a resource exhaustion vulnerability (CWE-400) in urllib3 version 2.6.3 related to its streaming API with Brotli decompression. Three independent code paths in response.py bypass the max_length protection introduced in version 2.6.0 to mitigate a prior vulnerability (CVE-2025-66471). Specifically, negative max_length values can result from buffer arithmetic in read(), flush_decoder forcibly sets max_length to -1, and _flush_decoder() omits any limit, defaulting to unlimited decompression. This allows a malicious HTTP server to cause excessive memory allocation during decompression, leading to denial of service via out-of-memory conditions. The vulnerability also affects Brotli version 1.2.0. There is no vendor advisory or patch information currently available.

Successful exploitation allows a remote attacker controlling an HTTP server to cause an out-of-memory condition in clients using urllib3 2.6.3 with Brotli 1.2.0 during streaming decompression. This results in denial of service (application crash or unresponsiveness). No confidentiality or integrity impacts are reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid streaming content with preload_content=False from untrusted HTTP servers when using urllib3 2.6.3 with Brotli 1.2.0. Consider disabling Brotli support or upgrading to versions once a fix is released.