CVE-2026-44432

urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.
References
Link Resource
https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j Mitigation Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:15862
https://access.redhat.com/errata/RHSA-2026:20338
https://access.redhat.com/errata/RHSA-2026:22934
https://access.redhat.com/errata/RHSA-2026:24000
https://access.redhat.com/errata/RHSA-2026:24009
https://access.redhat.com/errata/RHSA-2026:24014
https://access.redhat.com/errata/RHSA-2026:24069
https://access.redhat.com/errata/RHSA-2026:24374
https://access.redhat.com/errata/RHSA-2026:24476
https://access.redhat.com/errata/RHSA-2026:24483
https://access.redhat.com/errata/RHSA-2026:24540
https://access.redhat.com/errata/RHSA-2026:24541
https://access.redhat.com/errata/RHSA-2026:24542
https://access.redhat.com/errata/RHSA-2026:24544
https://access.redhat.com/errata/RHSA-2026:25039
https://access.redhat.com/errata/RHSA-2026:25143
https://access.redhat.com/errata/RHSA-2026:25928
https://access.redhat.com/errata/RHSA-2026:26212
https://access.redhat.com/errata/RHSA-2026:26304
https://access.redhat.com/errata/RHSA-2026:27929
https://access.redhat.com/errata/RHSA-2026:28000
https://access.redhat.com/errata/RHSA-2026:28157
https://access.redhat.com/errata/RHSA-2026:28158
https://access.redhat.com/errata/RHSA-2026:28159
https://access.redhat.com/errata/RHSA-2026:28571
https://access.redhat.com/errata/RHSA-2026:30076
https://access.redhat.com/errata/RHSA-2026:30078
https://access.redhat.com/errata/RHSA-2026:30087
https://access.redhat.com/errata/RHSA-2026:30088
https://access.redhat.com/errata/RHSA-2026:30089
https://access.redhat.com/errata/RHSA-2026:32992
https://access.redhat.com/errata/RHSA-2026:33313
https://access.redhat.com/errata/RHSA-2026:33683
https://access.redhat.com/errata/RHSA-2026:34160
https://access.redhat.com/errata/RHSA-2026:34374
https://access.redhat.com/errata/RHSA-2026:34526
https://access.redhat.com/errata/RHSA-2026:34531
https://access.redhat.com/errata/RHSA-2026:34533
https://access.redhat.com/errata/RHSA-2026:34607
https://access.redhat.com/errata/RHSA-2026:36350
https://access.redhat.com/errata/RHSA-2026:37275
https://access.redhat.com/errata/RHSA-2026:41066
https://access.redhat.com/errata/RHSA-2026:42078
https://access.redhat.com/errata/RHSA-2026:42079
https://access.redhat.com/errata/RHSA-2026:42132
https://access.redhat.com/errata/RHSA-2026:42144
https://access.redhat.com/errata/RHSA-2026:42644
https://access.redhat.com/errata/RHSA-2026:42796
https://access.redhat.com/errata/RHSA-2026:43038
https://access.redhat.com/errata/RHSA-2026:44481
https://access.redhat.com/errata/RHSA-2026:51206
https://access.redhat.com/errata/RHSA-2026:56347
https://access.redhat.com/errata/RHSA-2026:58981
https://access.redhat.com/errata/RHSA-2026:59409
https://access.redhat.com/errata/RHSA-2026:60362
https://access.redhat.com/errata/RHSA-2026:60371
https://access.redhat.com/errata/RHSA-2026:7625
https://access.redhat.com/errata/RHSA-2026:7634
https://access.redhat.com/security/cve/CVE-2026-44432
https://bugzilla.redhat.com/show_bug.cgi?id=2477154
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44432.json
Configurations

Configuration 1 (hide)

cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-13 16:16

Updated : 2026-09-10 13:20


NVD link : CVE-2026-44432

Mitre link : CVE-2026-44432

CVE.ORG link : CVE-2026-44432


JSON object : View

Products Affected

python

  • urllib3
CWE
CWE-409

Improper Handling of Highly Compressed Data (Data Amplification)