urllib3 versions 2.5.0 and earlier allow an unbounded number of chained HTTP content encodings, which can be exploited by a malicious server to cause excessive CPU and memory usage during decompression. This affects applications using urllib3 for HTTP requests to untrusted sources unless content decoding is disabled. The issue is fixed in urllib3 version 2.6.0 by limiting the decompression chain to 5 links. For users unable to upgrade immediately, disabling automatic content decoding and manually checking the content-encoding header is recommended.