# CVE-2026-44432

## Summary

- **CVE ID:** CVE-2026-44432
- **Severity:** HIGH
- **CVSS Score:** 8.9 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H)
- **CWE:** CWE-409
- **Published:** May 13, 2026
- **Last Modified:** Sep 10, 2026

## Description

urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.

## Affected Products

- urllib3 — urllib3 (>= 2.6.0, < 2.7.0)

## References

- [CNA](https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j)
- [redhat-SADP](https://access.redhat.com/security/cve/CVE-2026-44432)
- [redhat-SADP](https://bugzilla.redhat.com/show_bug.cgi?id=2477154)
- [redhat-SADP](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44432.json)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:27929)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:32992)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:28159)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:28157)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:28000)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:28158)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:30078)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:30089)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:30088)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:30087)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24542)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24540)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24544)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24541)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:25928)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:20338)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33313)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:25039)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:7634)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24069)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:25143)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24014)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24374)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:7625)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24000)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24009)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22934)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:15862)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:30076)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:28571)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26304)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26212)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24476)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24483)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33683)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34160)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34374)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34607)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34531)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34526)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34533)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36350)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:37275)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:23992)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41066)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42078)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42079)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42144)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42132)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42644)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:43038)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42796)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:44481)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:51206)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:56347)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:58981)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:59409)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:60362)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:60371)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.68%
- **EPSS Percentile:** 50.3

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._