Threats tagged 'brew-icloudpd-cve-2026-21441'

A vulnerability in icloudpd versions >=1.17.3 and <1.33.0 allows bypassing decompression-bomb safeguards when following HTTP redirects using urllib3's streaming API. The issue occurs because urllib3 decompresses the entire response body of redirect responses before any read methods are called, without respecting configured read limits. This can lead to excessive CPU and memory consumption, potentially causing denial of service. The vulnerability is fixed in icloudpd version 1.33.0.