The urllib3 library's streaming API can enter an infinite loop when processing chunked HTTP responses that are compressed with Deflate encoding. This occurs if the decompressed body exceeds the requested chunk size and the encoded body contains trailing bytes after the end of the Deflate stream. Python's zlib retains these trailing bytes as unconsumed input, causing urllib3 to repeatedly attempt to decode the same bytes without progress or additional network reads. This flaw affects urllib3 versions from 2.6.2 through 2.7.0 and can be exploited by a malicious server to cause a denial of service via excessive CPU consumption.

A malicious server can exploit this vulnerability to cause a client using affected urllib3 versions to enter an infinite loop during response decompression, leading to excessive CPU usage and stalled requests. Network timeouts do not interrupt this loop, potentially causing denial of service conditions in applications relying on urllib3 for HTTP streaming with deflate-encoded chunked responses.

An official fix is available in urllib3 version 2.8.0, which correctly stops the Deflate decoder from accepting input after the end of the compressed stream. Users should upgrade to urllib3 2.8.0 or later. If immediate upgrade is not possible, disable automatic content decoding for responses from untrusted sources by setting decode_content=False or reject streamed responses using Deflate content encoding. Applications disabling automatic decoding must handle compressed responses safely at another layer.