AIKIDO-2026-10160

TL;DR

Affected versions of this package may decompress entire HTTP redirect response bodies even when using the streaming API with preload_content=False, ignoring read limits. It can lead to excessive CPU and memory usage. An attacker can exploit this by hosting a redirect response containing a compressed decompression bomb, causing the client to automatically decompress massive data before any reads occur, resulting in denial of service.