CVE-2026-21441: Urllib3 Drain Conn Decompression Bombcve-2026-21441-urllib3-drain-conn-decompression-bomb
When draining an HTTPResponse connection, calling `read()` without explicitly disabling `decode_content` can cause unnecessary decompression of the response body. This leaves the client vulnerable to decompression bomb DoS attacks when processing untrusted HTTP redirects. Explicitly pass `decode_content=False` or the current decoder state to prevent unbounde
