The urllib3 library's streaming API reads chunked-transfer-encoded HTTP responses by buffering the chunk-size field until a newline or EOF is encountered. A malicious HTTP server can exploit this by sending a very long chunk-size field without newlines, causing urllib3 to buffer an unbounded amount of data in memory. This vulnerability affects urllib3 versions before 2.8.0, specifically impacting the read_chunked() and stream() methods. The fix implemented in version 2.8.0 rejects chunk-size fields larger than 65536 bytes, preventing excessive memory allocation. The issue does not affect the chunk data itself, only the chunk-size field parsing.

Applications and libraries using urllib3 versions earlier than 2.8.0 that stream chunked HTTP responses from untrusted sources may experience excessive memory usage due to unbounded buffering of the chunk-size field. This can lead to denial of service by resource exhaustion. Non-malicious servers are not impacted. The vulnerability also affects the requests library streaming API, which relies on urllib3.

Upgrade to urllib3 version 2.8.0 or later, where chunk-size fields larger than 65536 bytes are rejected to prevent unbounded memory buffering. If immediate upgrade is not possible, avoid using the streaming API methods read_chunked() and stream() on untrusted sources and instead read the entire response at once using the read() method.