CVE-2026-97688: 
Python Análisis y mitigación de vulnerabilidades

CVE-2026-97688 is a Denial of Service vulnerability in the Python urllib3 HTTP client library caused by an infinite loop during chunked Deflate response decoding. It affects urllib3 versions >= 2.6.2 and < 2.8.0. The vulnerability was published on September 29, 2026, with the fix released in version 2.8.0. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, Red Hat).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition). When urllib3 streams a compressed, chunked HTTP response, it first consumes data already buffered by the Deflate decoder before reading the next HTTP chunk. In affected versions, Python's zlib implementation retains trailing bytes after the end of the compressed stream as unconsumed_tail. urllib3 repeatedly calls decompress() on these same trailing bytes without making progress or reading more data from the network, resulting in an infinite loop. The fix in commit ea2ad7b adds a check for self._obj.eof in the DeflateDecoder.decompress() method — if the zlib object has reached EOF, no further decoding is attempted, and has_unconsumed_tail is updated to exclude the EOF state (Github Advisory, Patch Commit).

A malicious server can cause any client application using a vulnerable urllib3 version to consume excessive CPU resources and hang indefinitely on affected requests. There is no confidentiality or integrity impact; the effect is purely an availability denial of service on the client side. Critically, network read timeouts do not interrupt the loop because no further socket read operation occurs once the trailing bytes are buffered, making the hang persistent until the process is killed (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.291%, placing it in the 20th percentile for exploitation likelihood. However, the attack is automatable and requires no authentication or user interaction — any application that connects to an attacker-controlled server and streams Deflate-encoded chunked responses is potentially at risk (Github Advisory).

1. Set up a malicious HTTP server: Configure a server to respond with HTTP headers Transfer-Encoding: chunked and Content-Encoding: deflate.
2. Craft the malicious response body: Compress a payload using Deflate (zlib), then append extra trailing bytes after the end of the valid Deflate stream (e.g., compressed_data = zlib.compress(b'A' * 100) + b'tail').
3. Deliver the response in chunks: Send the crafted compressed data as a chunked HTTP response to a client using urllib3 versions 2.6.2–2.7.0 with content decoding enabled.
4. Trigger the infinite loop: When the client calls HTTPResponse.stream(amt=N) or HTTPResponse.read_chunked(amt=N) with a positive finite chunk size, and the decoded body exceeds that chunk size, the Deflate decoder retains the trailing bytes as unconsumed_tail and repeatedly attempts to decode them without progress.
5. Achieve denial of service: The client process enters an infinite CPU-consuming loop and the request never completes; network read timeouts do not interrupt the loop since no further socket reads occur (Github Advisory, Patch Commit).

• Process: Python processes consuming abnormally high CPU (near 100%) for extended periods without completing HTTP requests; processes that appear hung and unresponsive to network timeouts.
• Logs: Application logs showing HTTP requests to external servers that never return a response or complete; absence of response completion log entries for requests to untrusted or unexpected hosts.
• Network: Outbound HTTP connections to suspicious servers that remain open indefinitely with no data transfer after the initial response headers and body are received; responses with both Transfer-Encoding: chunked and Content-Encoding: deflate headers from untrusted sources.

Upgrade urllib3 to version 2.8.0 or later, which fixes the infinite loop by ensuring the Deflate decoder stops accepting input after reaching end-of-stream (urllib3 Release). If an immediate upgrade is not possible, set decode_content=False when making requests to untrusted servers to disable automatic content decoding, or explicitly reject streamed responses that use Content-Encoding: deflate. Applications disabling automatic decoding must handle decompression safely at another layer (Github Advisory).