CVE-2026-9375 is a high-severity vulnerability in urllib3 version 2.6.3 and Brotli 1.2.0 involving uncontrolled resource consumption (CWE-400) via a decompression bomb bypass in the streaming API when preload_content is false. The vulnerability stems from three independent code paths in response.py that bypass the max_length protection introduced in urllib3 2.6.0 to mitigate a previous CVE. Specifically, negative max_length values can be produced due to buffer arithmetic in read(), flush_decoder unconditionally sets max_length to -1, and _flush_decoder() passes no limit, defaulting to unlimited decompression. This allows a malicious HTTP server to trigger an out-of-memory condition by decompressing large payloads into memory, resulting in denial of service. The vulnerability affects applications and libraries using requests or urllib3 to stream content from untrusted sources.

Successful exploitation can cause an out-of-memory condition on the client side, leading to denial of service. There is no impact on confidentiality or integrity reported. The vulnerability affects the availability of applications using vulnerable versions of urllib3 and Brotli when streaming content from untrusted HTTP servers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should avoid streaming content with preload_content set to false when using Brotli decompression on affected versions or implement other controls to limit resource consumption until a fix is available.