8.9
High
CVE-2026-44432 urllib3 is an HTTP client library for Python
Description
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| urllib3 2.6 | 2.6.0 → < 2.7.0 | 2.7.0 |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 8) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 9) | Versions not published | |
| Red Hat Enterprise Linux BaseOS (v. 10) | Versions not published | |
| Red Hat Enterprise Linux BaseOS (v. 9) | Versions not published | |
| Red Hat AI Inference Server 3.3 1782352847 | earliest → < 1782352847 | 1782352847 |
| Red Hat AI Inference Server 3.4 1780356914 | earliest → < 1780356914 | 1780356914 |
| Red Hat Ansible Automation Platform 2.7 1781102816 | earliest → < 1781102816 | 1781102816 |
Show the 50 other branches Hide the 50 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Discovery 2 1782756541 | earliest → < 1782756541 | 1782756541 |
| Red Hat Hardened Images | Versions not published | |
| Red Hat Quay 3.12 1781937357 | earliest → < 1781937357 | 1781937357 |
| Red Hat Quay 3.9 1781878070 | earliest → < 1781878070 | 1781878070 |
| Red Hat Satellite 6.18 1782739344 | earliest → < 1782739344 | 1782739344 |
| Red Hat Trusted Artifact Signer 1.3 1780560117 | earliest → < 1780560117 | 1780560117 |
| Red Hat Trusted Artifact Signer 1.4 1780914886 | earliest → < 1780914886 | 1780914886 |
| Migration Toolkit for Applications 8 | Versions not published | |
| OpenShift Lightspeed | Versions not published | |
| Pen Drive Powered by Red Hat Lightspeed | Versions not published | |
| Red Hat AI Inference Server | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat Quay 3 | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Service Telemetry Framework 1.5 | Versions not published | |
| Exploit Intelligence | Versions not published | |
| External Secrets Operator for Red Hat OpenShift | Versions not published | |
| Migration Toolkit for Containers | Versions not published | |
| Migration Toolkit for Virtualization | Versions not published | |
| OpenShift Service Mesh 3 | Versions not published | |
| Red Hat build of Quarkus Native builder | Versions not published | |
| Red Hat Developer Hub | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 6 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| Red Hat OpenStack Platform 17.1 | Versions not published | |
| Red Hat Update Infrastructure 4 for Cloud Providers | Versions not published | |
| Red Hat Quay 3.10 1782487717 | earliest → < 1782487717 | 1782487717 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 1783969139 | earliest → < 1783969139 | 1783969139 |
| Red Hat Satellite 6.19 1784558259 | earliest → < 1784558259 | 1784558259 |
| Red Hat OpenShift AI 3.3 1782472374 | earliest → < 1782472374 | 1782472374 |
| Red Hat Quay 3.16 1783955846 | earliest → < 1783955846 | 1783955846 |
| Red Hat Quay 3.1 1782487717 | earliest → < 1782487717 | 1782487717 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 1784050598 | earliest → < 1784050598 | 1784050598 |
| Red Hat OpenShift AI 2.25 1783998857 | earliest → < 1783998857 | 1783998857 |
| Red Hat Migration Toolkit for Applications 8.2 1786481481 | earliest → < 1786481481 | 1786481481 |
| Red Hat Quay 3.15 1784351966 | earliest → < 1784351966 | 1784351966 |
| Red Hat Update Infrastructure 5 1787241260 | earliest → < 1787241260 | 1787241260 |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | Versions not published | |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | Versions not published | |
| Red Hat Enterprise Linux 9.6 Extended Update Support | Versions not published |
References
- github.com github.com
Timeline
- Published
- Last modified