Junglewise Threat Intelligence

CVE-2026-44432: urllib3 resource exhaustion via improper handling of compressed data

CVE-2026-44432 · Severity: high · CVSS 7.5 · Published 2026-05-13

Technologies: Urllib3. Vendors: PyPI.

Executive brief

urllib3, a widely used Python library for making web requests, contains a vulnerability that can cause it to consume excessive system resources. When processing specially crafted compressed data from a website, the library may attempt to decompress the entire response at once instead of in small pieces as intended. This can lead to high CPU usage and massive memory consumption, potentially causing the application to crash or become unresponsive.

Technical details

A resource exhaustion vulnerability (CWE-409) exists in urllib3's streaming API when handling compressed responses. In versions 2.6.0 through 2.6.x, the library may decompress an entire response body in a single operation rather than respecting the requested chunk size (amt=N). This occurs specifically during the second call to HTTPResponse.read() when using the official Brotli library, or when HTTPResponse.drain_conn() is called after partial decompression. An attacker providing a highly compressed 'decompression bomb' can trigger excessive CPU and memory allocation on the client side. The issue is fixed in version 2.7.0 by improving Brotli read efficiency and skipping decompression during connection draining.

Affected products

  • urllib3 urllib3 >=2.6.0, <2.7.0

Timeline

  • 2026-05-07: advisory: GitHub Security Advisory published
  • 2026-05-13: disclosed: NVD publication date
  • 2026-05-07: patched: Fixed in version 2.7.0

References

Related threats