The vulnerability CVE-2026-21441 affects urllib3 versions starting from 1.22 up to but not including 2.6.3. urllib3's streaming API decompresses HTTP redirect response bodies fully and prematurely, even when preload_content=False, ignoring read limits and enabling decompression bomb attacks. This can cause excessive CPU and memory consumption, leading to denial of service. Applications that stream content from untrusted sources with redirects enabled are vulnerable. The issue is tracked under CWE-409 (Improper Handling of Highly Compressed Data). Red Hat's advisory confirms the vulnerability affects multiple Red Hat products that include urllib3, including Red Hat Enterprise Linux and Zero Trust Workload Identity Manager. The vendor advisory does not indicate a released fix yet but recommends upgrading urllib3 to version 2.6.3 or later or disabling redirects as a mitigation.

The vulnerability allows a malicious HTTP server to cause excessive resource consumption (CPU and memory) on clients using urllib3's streaming API with redirects enabled and preload_content=False. This can lead to denial of service conditions such as degraded system performance or crashes. There is no impact on confidentiality or integrity reported. The severity is high due to the potential for resource exhaustion and service disruption.

Red Hat's advisory does not indicate an official fix has been released yet. Users should upgrade urllib3 to version 2.6.3 or later, where the issue is resolved by not decoding redirect response content when preload_content=False. If upgrading is not immediately possible, disable HTTP redirects by setting redirect=False when streaming content from untrusted sources. Monitor Red Hat advisories for updates on official patches or fixes.