{"action":"Upgrade urllib3 to 2.6.0 or later.","affected":[{"fixed":"2.6.0","introduced":"1.24"}],"component":"urllib3","cve_ids":["CVE-2025-66418"],"ecosystem":"PyPI","epss":0.00682,"exploited":false,"fixed_versions":["2.6.0"],"ghsa_id":"GHSA-gm62-xv2j-4w53","id":"tcs_01M5KGWWZ83JE5GVYKW8K0CPVR","modified_at":"2026-07-07T17:47:54.140852492Z","published_at":"2026-07-07T16:03:12.278581Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1998","https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53","https://nvd.nist.gov/vuln/detail/CVE-2025-66418","https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8","https://github.com/urllib3/urllib3","https://pypi.org/project/urllib3","https://github.com/advisories/GHSA-gm62-xv2j-4w53"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-1998","url":"https://osv.dev/vulnerability/PYSEC-2026-1998"},{"source":"nvd","source_id":"CVE-2025-66418","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66418"}],"summary":"urllib3 allows an unbounded number of links in the decompression chain"}