CVE-2026-44432

Fixed in a distro release EPSS <1%CVSS 8.9

urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.

Published 2026-05-13 · CVE record · OSV

Products: urllib3, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat AI Inference Server 3.3, Red Hat AI Inference Server 3.4, Red Hat Ansible Automation Platform 2.5, Red Hat Ansible Automation Platform 2.6, Red Hat Ansible Automation Platform 2.7, Red Hat Discovery 2, Red Hat Hardened Images, Red Hat Migration Toolkit for Applications 8.2, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat Quay 3.10, Red Hat Quay 3.12, Red Hat Quay 3.15, Red Hat Quay 3.16, Red Hat Quay 3.9, Red Hat Satellite 6.18, Red Hat Satellite 6.19, Red Hat Trusted Artifact Signer 1.3, Red Hat Trusted Artifact Signer 1.4, Red Hat Update Infrastructure 5, Red Hat Exploit Intelligence, External Secrets Operator for Red Hat OpenShift, Red Hat Migration Toolkit for Containers, Red Hat Migration Toolkit for Virtualization, Red Hat OpenShift Lightspeed, Red Hat OpenShift Service Mesh 3, Pen Drive Powered by Red Hat Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat build of Quarkus Native builder, Red Hat Developer Hub, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenShift Virtualization 4, Red Hat OpenStack Platform 17.1, Red Hat Satellite 6, Red Hat Update Infrastructure 4 for Cloud Providers, Red Hat Service Telemetry Framework 1.5

Fixed upstream

Distro releases