CVE-2026-44432
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
The urllib3 HTTP client library for Python versions 2.6.0 to before 2.7.0 contains a vulnerability where the entire response is decompressed instead of the requested portion during the second HTTPResponse.read(amt=N) call when using the official Brotli library, or after HTTPResponse.drain_conn() is called after partial read. This can lead to excessive resource consumption (high CPU usage and memory allocation) on the client side.
Risk Assessment
An attacker can deliver a small, highly compressed response that, upon decompression, causes significant resource consumption on the client, potentially leading to denial of service (DoS) or memory exhaustion.
Recommendation
It is recommended to immediately upgrade urllib3 to version 2.7.0 or later.
Other vulnerabilities in urllib3
Original NVD description (English source)
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.