The Fix
pip install urllib3==3.9.7
Based on closed urllib3/urllib3 issue #2513 · PR/commit linked
Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.
@@ -0,0 +1 @@
@@ -0,0 +1 @@
+Fixed reading 2 or more GiB of data at a time using ``urllib3.response.HTTPResponse.read``.
\ No newline at end of file
diff --git a/src/urllib3/response.py b/src/urllib3/response.py
repro.py
url = "https://dailymed-data.nlm.nih.gov/public-release-files/dm_spl_release_human_rx_part1.zip"
resp = http.request("GET", url)
resp.data
resp = http.request("GET", url, preload_content=False)
list(resp.stream(None))
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
fix.md
Option A — Upgrade to fixed release\npip install urllib3==3.9.7\nWhen NOT to use: This fix is not suitable for environments where reading large data is expected without streaming.\n\n
Why This Fix Works in Production
- Trigger: resp = http.request("GET", "https://dailymed-data.nlm.nih.gov/public-release-files/dm_spl_release_human_rx_part1.zip")
- Mechanism: The OverflowError occurs when reading more than 2GB of data due to limitations in OpenSSL
- Why the fix works: Fixes an OverflowError when reading large amounts of data via SSL in urllib3.response.HTTPResponse. (first fixed release: 3.9.7).
Production impact:
- If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.
Why This Breaks in Prod
- Shows up under Python 3.8 in real deployments (not just unit tests).
- The OverflowError occurs when reading more than 2GB of data due to limitations in OpenSSL
- Surfaces as: Traceback (most recent call last):
Proof / Evidence
- GitHub issue: #2513
- Fix PR: https://github.com/urllib3/urllib3/pull/2657
- First fixed release: 3.9.7
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.95
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.41
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“When CPython is used, the error should only happen since 3.8.0a4 (https://github.com/python/cpython/issues/80231, https://github.com/python/cpython/commit/d6bf6f2d0c83f0c64ce86e7b9340278627798090), it was fixed in 3.9.7 (https://github.com/python/cpython/issue”
“Thanks for bringing this up! Excited to see a solution, we've been hitting this as well. In the meanwhile does anyone happen to have any…”
“The best solution is to stream the response data instead of loading all at once. You'll likely want to do this anyways (even with the…”
“@illia-v Hmm! Could you create a PR with your changes so we can see test results? Would be good to understand all the cases where…”
Failure Signature (Search String)
- resp = http.request("GET", "https://dailymed-data.nlm.nih.gov/public-release-files/dm_spl_release_human_rx_part1.zip")
Error Message
Stack trace
error.txt
Error Message
-------------
Traceback (most recent call last):
File "/home/sethmlarson/urllib3/testme.py", line 5, in <module>
resp = http.request("GET", "https://dailymed-data.nlm.nih.gov/public-release-files/dm_spl_release_human_rx_part1.zip")
File "/home/sethmlarson/urllib3/src/urllib3/__init__.py", line 112, in request
return _DEFAULT_POOL.request(
File "/home/sethmlarson/urllib3/src/urllib3/_request_methods.py", line 109, in request
return self.request_encode_url(
File "/home/sethmlarson/urllib3/src/urllib3/_request_methods.py", line 142, in request_encode_url
return self.urlopen(method, url, **extra_kw)
File "/home/sethmlarson/urllib3/src/urllib3/poolmanager.py", line 443, in urlopen
response = conn.urlopen(method, u.request_uri, **kw)
File "/home/sethmlarson/urllib3/src/urllib3/connectionpool.py", line 744, in urlopen
response = self.ResponseCls.from_httplib(
File "/home/sethmlarson/urllib3/src/urllib3/response.py", line 748, in from_httplib
resp = ResponseCls(
File "/home/sethmlarson/urllib3/src/urllib3/response.py", line 467, in __init__
self._body = self.read(decode_content=decode_content)
File "/home/sethmlarson/urllib3/src/urllib3/response.py", line 664, in read
data = self._fp.read() if not fp_closed else b""
File "/home/sethmlarson/.pyenv/versions/3.8.6/lib/python3.8/http/client.py", line 471, in read
s = self._safe_read(self.length
... (truncated) ...
Minimal Reproduction
repro.py
url = "https://dailymed-data.nlm.nih.gov/public-release-files/dm_spl_release_human_rx_part1.zip"
resp = http.request("GET", url)
resp.data
resp = http.request("GET", url, preload_content=False)
list(resp.stream(None))
Environment
- Python: 3.8
What Broke
Users experience crashes when attempting to read large responses over SSL.
Why It Broke
The OverflowError occurs when reading more than 2GB of data due to limitations in OpenSSL
Fix Options (Details)
Option A — Upgrade to fixed release Safe default (recommended)
pip install urllib3==3.9.7
When NOT to use: This fix is not suitable for environments where reading large data is expected without streaming.
Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.
Fix reference: https://github.com/urllib3/urllib3/pull/2657
First fixed release: 3.9.7, v3.10
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- This fix is not suitable for environments where reading large data is expected without streaming.
Verify Fix
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
- Upgrade behind a canary and run integration tests against the canary before 100% rollout.
- Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
- Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.
Version Compatibility Table
| Version | Status |
|---|---|
| 3.10.0 | Fixed |
| 3.9.7 | Fixed |
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.