Threats tagged 'brew-icloudpd-cve-2026-97689'

urllib3 versions prior to 2.8.0 have a vulnerability in their streaming API where the chunk-size field in chunked-transfer-encoded HTTP responses can be unboundedly large. This allows a malicious server to cause excessive memory allocation by sending a very long chunk-size line without newline characters. The issue affects the read_chunked() and stream() methods when handling chunked responses from untrusted sources. The vulnerability is fixed in urllib3 version 2.8.0 by rejecting chunk-size fields larger than 65536 bytes.