Log in Start free

Vulnerability · Published May 13, 2026 · Assigned by GitHub_M

CVE-2026-44432urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

High 7.5

In plain English

A high-severity security flaw in urllib3 from urllib3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 47.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10python3-urllib31.26.19-4.el10_2ALSA-2026:28000
AlmaLinux:9python3-urllib31.26.5-8.el9_8ALSA-2026:28158
AlmaLinux:8python3.12-urllib31.26.19-3.el8_10ALSA-2026:32992
AlmaLinux:9python3.12-urllib31.26.19-3.el9_8ALSA-2026:28159
AlmaLinux:10python3.14-urllib32.6.3-2.el10_2ALSA-2026:27929
AlmaLinux:9python3.14-urllib32.6.3-2.el9_8ALSA-2026:28157
Debian:14python-urllib32.7.0-1DEBIAN-CVE-2026-44432
PyPIurllib32.7.0PYSEC-2026-142
PyPIurllib32.7.0GHSA-mf9v-mfxr-j63j
Rocky Linux:10python-urllib30:1.26.19-4.el10_2RLSA-2026:28000
Rocky Linux:9python-urllib30:1.26.5-8.el9_8RLSA-2026:28158
Rocky Linux:8python3.12-urllib30:1.26.19-3.el8_10RLSA-2026:32992
Rocky Linux:9python3.12-urllib30:1.26.19-3.el9_8RLSA-2026:28159
Rocky Linux:10python3.14-urllib30:2.6.3-2.el10_2RLSA-2026:27929
Rocky Linux:9python3.14-urllib30:2.6.3-2.el9_8RLSA-2026:28157
Ubuntu:25.10python-pipno fix listedUBUNTU-CVE-2026-44432
Ubuntu:26.10python-pipno fix listedUBUNTU-CVE-2026-44432
Ubuntu:26.04:LTSpython-urllib32.6.3-1ubuntu1.1UBUNTU-CVE-2026-44432

Affected products (as reported)

VendorProductVersions
urllib3 urllib3 >= 2.6.0, < 2.7.0

Weakness: CWE-409 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References