# CVE-2026-44432: urllib3 resource exhaustion via improper handling of compressed data

Source: https://junglewise.ai/threats/cve-2026-44432-urllib3-resource-exhaustion-via-improper-handling-of-compressed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-44432 · Severity: high · CVSS 7.5 · Published 2026-05-13

urllib3, a widely used Python library for making web requests, contains a vulnerability that can cause it to consume excessive system resources. When processing specially crafted compressed data from a website, the library may attempt to decompress the entire response at once instead of in small pieces as intended. This can lead to high CPU usage and massive memory consumption, potentially causing the application to crash or become unresponsive.

Technologies: [urllib3 (PyPI)](https://junglewise.ai/threats/technologies/urllib3). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-44432 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44432 being exploited in the wild.

**How severe is CVE-2026-44432?** High severity, with a CVSS score of 7.5, published 13 May 2026.

**Which products and versions are affected?** urllib3 (PyPI) >= 2.6.0, < 2.7.0, ECOSYSTEM:introduced=2.6.0,fixed=2.7.0.

**Is there a fix for CVE-2026-44432?** Yes. urllib3 (PyPI): upgrade to 2.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44432 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44432?** Check whether you run urllib3 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- urllib3 (PyPI): upgrade to 2.7.0 or later

  ```sh
  pip install "urllib3>=2.7.0"
  ```


## Technical details

A resource exhaustion vulnerability (CWE-409) exists in urllib3's streaming API when handling compressed responses. In versions 2.6.0 through 2.6.x, the library may decompress an entire response body in a single operation rather than respecting the requested chunk size (amt=N). This occurs specifically during the second call to HTTPResponse.read() when using the official Brotli library, or when HTTPResponse.drain_conn() is called after partial decompression. An attacker providing a highly compressed 'decompression bomb' can trigger excessive CPU and memory allocation on the client side. The issue is fixed in version 2.7.0 by improving Brotli read efficiency and skipping decompression during connection draining.

## Affected products

- urllib3 urllib3 >=2.6.0, <2.7.0

## Identifiers

- CVE-2026-44432
- GHSA-mf9v-mfxr-j63j
- PYSEC-2026-142

## Timeline

- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: NVD publication date
- 2026-05-07: patched: Fixed in version 2.7.0

## References

- [https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j](https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j)
- [https://access.redhat.com/errata/RHSA-2026:15862](https://access.redhat.com/errata/RHSA-2026:15862)
- [https://access.redhat.com/errata/RHSA-2026:20338](https://access.redhat.com/errata/RHSA-2026:20338)
- [https://access.redhat.com/errata/RHSA-2026:22934](https://access.redhat.com/errata/RHSA-2026:22934)
- [https://access.redhat.com/errata/RHSA-2026:24000](https://access.redhat.com/errata/RHSA-2026:24000)
- [https://access.redhat.com/errata/RHSA-2026:24009](https://access.redhat.com/errata/RHSA-2026:24009)
- [https://access.redhat.com/errata/RHSA-2026:24014](https://access.redhat.com/errata/RHSA-2026:24014)

## Related threats

- [urllib3 HTTP client unbounded memory allocation in chunked transfer](https://junglewise.ai/threats/cve-2026-97689-urllib3-is-an-http-client-library-for-python-from-1-10-3-until-2)
- [urllib3 infinite loop in Deflate decoder](https://junglewise.ai/threats/cve-2026-97688-urllib3-is-an-http-client-library-for-python-from-2-6-2-until-2-8)
- [urllib3 HTTPS proxy TLS settings isolation](https://junglewise.ai/threats/cve-2026-97687-urllib3-is-an-http-client-library-for-python-from-1-26-0-until-2)
- [PYSEC-2026-1997 - urllib3 does not control redirects in browsers and Node.js](https://junglewise.ai/threats/cve-2025-50182-urllib3-does-not-control-redirects-in-browsers-and-node-js)
- [PYSEC-2026-1999 - urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation](https://junglewise.ai/threats/cve-2025-50181-urllib3-redirects-are-not-disabled-when-retries-are-disabled-on)