CVE-2026-44432: urllib3 resource exhaustion via improper handling of compressed data

CVE-2026-44432 · Severity: high · CVSS 7.5 · Published 2026-05-13

urllib3, a widely used Python library for making web requests, contains a vulnerability that can cause it to consume excessive system resources. When processing specially crafted compressed data from a website, the library may attempt to decompress the entire response at once instead of in small pieces as intended. This can lead to high CPU usage and massive memory consumption, potentially causing the application to crash or become unresponsive.

Technologies: urllib3 (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-44432 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44432 being exploited in the wild.
How severe is CVE-2026-44432?
High severity, with a CVSS score of 7.5, published 13 May 2026.
Which products and versions are affected?
urllib3 (PyPI) >= 2.6.0, < 2.7.0, ECOSYSTEM:introduced=2.6.0,fixed=2.7.0.
Is there a fix for CVE-2026-44432?
Yes. urllib3 (PyPI): upgrade to 2.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44432 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44432?
Check whether you run urllib3 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • urllib3 (PyPI): upgrade to 2.7.0 or later
    pip install "urllib3>=2.7.0"

Technical details

A resource exhaustion vulnerability (CWE-409) exists in urllib3's streaming API when handling compressed responses. In versions 2.6.0 through 2.6.x, the library may decompress an entire response body in a single operation rather than respecting the requested chunk size (amt=N). This occurs specifically during the second call to HTTPResponse.read() when using the official Brotli library, or when HTTPResponse.drain_conn() is called after partial decompression. An attacker providing a highly compressed 'decompression bomb' can trigger excessive CPU and memory allocation on the client side. The issue is fixed in version 2.7.0 by improving Brotli read efficiency and skipping decompression during connection draining.

Affected products

  • urllib3 urllib3 >=2.6.0, <2.7.0

Identifiers

  • CVE-2026-44432
  • GHSA-mf9v-mfxr-j63j
  • PYSEC-2026-142

Timeline

  • 2026-05-07: advisory: GitHub Security Advisory published
  • 2026-05-13: disclosed: NVD publication date
  • 2026-05-07: patched: Fixed in version 2.7.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.