Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2026-44432

Improper Handling of Highly Compressed Data (Data Amplification)

Published: May 13, 2026 | Modified: May 14, 2026
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
7.5 IMPORTANT
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-44432
CWEhttps://cwe.mitre.org/data/definitions/409.html

urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.

Weakness

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Affected Software

NameVendorStart VersionEnd Version
Urllib3Python2.6.0 (including)2.7.0 (excluding)
Red Hat AI Inference Server 3.4RedHatrhaii/vllm-cpu-rhel9:1780356811*
Red Hat AI Inference Server 3.4RedHatrhaii/vllm-spyre-rhel9:1780356904*
Red Hat AI Inference Server 3.4RedHatrhaii/model-opt-cuda-rhel9:1780356941*
Red Hat AI Inference Server 3.4RedHatrhaii/vllm-cuda-rhel9:1780356914*
Red Hat Ansible Automation Platform 2.7RedHatansible-automation-platform-27/eda-controller-rhel9:1781028735*
Red Hat Ansible Automation Platform 2.7RedHatansible-automation-platform-27/hub-rhel9:1781102816*
Red Hat Discovery 2RedHatdiscovery/discovery-server-rhel9:1779395228*
Red Hat Discovery 2RedHatdiscovery/discovery-server-rhel9:1779395228*
Red Hat Hardened ImagesRedHattrivy-main-0.69.3-1.2.hum1*
Red Hat Hardened ImagesRedHatrust-main-1.96.0-1.hum1*
Red Hat Hardened ImagesRedHatpython-trustme-main-1.2.1-2.hum1*
Red Hat Hardened ImagesRedHatpython-urllib3-main-2.7.0-3.hum1*
Red Hat Hardened ImagesRedHatpython-cryptography-main-48.0.0-3.hum1*
Red Hat Hardened ImagesRedHatllvm21-main-21.1.8-6.hum1*
Red Hat Hardened ImagesRedHatpython-rpds-py-main-2026.5.1-1.hum1*
Red Hat Hardened ImagesRedHatjaeger-main-2.19.0-1.hum1*
Red Hat Hardened ImagesRedHatmariadb11-8-main-11.8.8-1.hum1*
Red Hat Hardened ImagesRedHatpython-sentry-sdk-main-2.48.0-4.1.hum1*
Red Hat Hardened ImagesRedHatllvm-main-21.1.8-1.1.hum1*
Red Hat Satellite 6.18RedHatsatellite/iop-puptoo-rhel9:1779792651*
Red Hat Satellite 6.18RedHatsatellite/iop-insights-engine-rhel9:1779711334*
Red Hat Trusted Artifact Signer 1.3RedHatrhtas/segment-reporting-rhel9:1780560117*
Red Hat Trusted Artifact Signer 1.4RedHatrhtas/model-transparency-rhel9:1780914886*
Python-urllib3Ubuntudevel*
Python-urllib3Ubunturesolute*
Python-urllib3Ubuntuupstream*

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use