CVE-2026-44432
published 2026-05-13CVE-2026-44432: urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1)…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.68%
52.1th percentile
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.
Affected
104 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9-operator | — | — |
| ansible-automation-platform-26 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | de-supported-rhel9 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9-operator | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-26 | gateway-rhel9-operator | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9-operator | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9-operator | — | — |
| ansible-automation-platform-26 | platform-resource-rhel9-operator | — | — |
| ansible-automation-platform-26 | platform-resource-runner-rhel9 | — | — |
| ansible-automation-platform-tech-preview | metrics-service-rhel9 | — | — |
| ansible-automation-platform-tech-preview | metrics-service-rhel9-operator | — | — |
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| aquasecurity | trivy | — | — |
| debian | python-cryptography | — | — |
| debian | python-urllib3 | — | — |
| discovery | discovery-server-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.9HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.9HIGH
vendor_ubuntu8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
urllib3 up to 2.6.x on Python HTTPResponse.drain_conn data amplification
vuldb·2026-05-13·CVSS 8.9
CVE-2026-44432 [HIGH] urllib3 up to 2.6.x on Python HTTPResponse.drain_conn data amplification
A vulnerability labeled as problematic has been found in urllib3 up to 2.6.x on Python. Impacted is the function HTTPResponse.drain_conn. Such manipulation leads to highly compressed data.
This vulnerability is uniquely identified as CVE-2026-44432. The attack can be launched remotely. No exploit exists.
The affected component should be upgraded.
GHSA
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
ghsa·2026-05-11
CVE-2026-44432 [HIGH] CWE-409 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
### Impact
urllib3's [streaming API](https://urllib3.readthedocs.io/en/2.7.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.
urllib3 can perform decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API since version 2.6.0, the library decompresses only the necessary bytes, enabling partial content consumption.
However, urllib3 before version 2.7.0 could still decompress the whole response instead of the requested portion in two cases:
1. During the second `HTTPResponse.read(amt=N)` cal
Ubuntu
urllib3 vulnerabilities
vendor_ubuntu·2026-06-03·CVSS 8.2
CVE-2026-44431 [HIGH] urllib3 vulnerabilities
Title: urllib3 vulnerabilities
Summary: Several security issues were fixed in urllib3.
It was discovered that urllib3 incorrectly handled cross-origin redirects
in ProxyManager. A remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-44431)
It was discovered that urllib3 incorrectly handled decompression of
specially crafted responses. A remote attacker could possibly use this
issue to cause urllib3 to consume resources, leading to a denial of
service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-44432)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
urllib3: urllib3: Denial of Service due to excessive HTTP response decompression
vendor_redhat·2026-05-13·CVSS 8.9
CVE-2026-44432 [HIGH] CWE-409 urllib3: urllib3: Denial of Service due to excessive HTTP response decompression
urllib3: urllib3: Denial of Service due to excessive HTTP response decompression
A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.
Package: exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 (Exploit Intelligence) - Not affected
Package: external-secrets-operator/bitwarden-sdk-server-rhel9 (External Secrets Operator for Red Hat OpenShift) - Not affected
Package: external-secr
No detection rules found.
No public exploits indexed.
https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63jhttps://access.redhat.com/errata/RHSA-2026:15862https://access.redhat.com/errata/RHSA-2026:20338https://access.redhat.com/errata/RHSA-2026:22934https://access.redhat.com/errata/RHSA-2026:24000https://access.redhat.com/errata/RHSA-2026:24009https://access.redhat.com/errata/RHSA-2026:24014https://access.redhat.com/errata/RHSA-2026:24069https://access.redhat.com/errata/RHSA-2026:24374https://access.redhat.com/errata/RHSA-2026:24476https://access.redhat.com/errata/RHSA-2026:24483https://access.redhat.com/errata/RHSA-2026:24540https://access.redhat.com/errata/RHSA-2026:24541https://access.redhat.com/errata/RHSA-2026:24542https://access.redhat.com/errata/RHSA-2026:24544https://access.redhat.com/errata/RHSA-2026:25039https://access.redhat.com/errata/RHSA-2026:25143https://access.redhat.com/errata/RHSA-2026:25928https://access.redhat.com/errata/RHSA-2026:26212https://access.redhat.com/errata/RHSA-2026:26304https://access.redhat.com/errata/RHSA-2026:27929https://access.redhat.com/errata/RHSA-2026:28000https://access.redhat.com/errata/RHSA-2026:28157https://access.redhat.com/errata/RHSA-2026:28158https://access.redhat.com/errata/RHSA-2026:28159https://access.redhat.com/errata/RHSA-2026:28571https://access.redhat.com/errata/RHSA-2026:30076https://access.redhat.com/errata/RHSA-2026:30078https://access.redhat.com/errata/RHSA-2026:30087https://access.redhat.com/errata/RHSA-2026:30088https://access.redhat.com/errata/RHSA-2026:30089https://access.redhat.com/errata/RHSA-2026:32992https://access.redhat.com/errata/RHSA-2026:33313https://access.redhat.com/errata/RHSA-2026:33683https://access.redhat.com/errata/RHSA-2026:34160https://access.redhat.com/errata/RHSA-2026:34374https://access.redhat.com/errata/RHSA-2026:34526https://access.redhat.com/errata/RHSA-2026:34531https://access.redhat.com/errata/RHSA-2026:34533https://access.redhat.com/errata/RHSA-2026:34607https://access.redhat.com/errata/RHSA-2026:36350https://access.redhat.com/errata/RHSA-2026:37275https://access.redhat.com/errata/RHSA-2026:41066https://access.redhat.com/errata/RHSA-2026:42078https://access.redhat.com/errata/RHSA-2026:42079https://access.redhat.com/errata/RHSA-2026:42132https://access.redhat.com/errata/RHSA-2026:42144https://access.redhat.com/errata/RHSA-2026:42644https://access.redhat.com/errata/RHSA-2026:42796https://access.redhat.com/errata/RHSA-2026:43038https://access.redhat.com/errata/RHSA-2026:44481https://access.redhat.com/errata/RHSA-2026:51206https://access.redhat.com/errata/RHSA-2026:56347https://access.redhat.com/errata/RHSA-2026:58981https://access.redhat.com/errata/RHSA-2026:59409https://access.redhat.com/errata/RHSA-2026:60362https://access.redhat.com/errata/RHSA-2026:60371https://access.redhat.com/errata/RHSA-2026:7625https://access.redhat.com/errata/RHSA-2026:7634https://access.redhat.com/security/cve/CVE-2026-44432https://bugzilla.redhat.com/show_bug.cgi?id=2477154https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44432.json
2026-05-13
Published