CVE-2026-44432— urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44432
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
Source: NVD (National Vulnerability Database)
Vulnerability Description
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: NVD (National Vulnerability Database)
Vulnerability Title
urllib3 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
urllib3是urllib3开源的一款Python HTTP库。该产品具有线程安全连接池、文件发布支持等。 urllib3 2.6.0版本至2.7.0之前版本存在安全漏洞，该漏洞源于在第二次HTTPResponse.read调用或drain_conn调用时可能解压缩整个响应而非请求部分，导致客户端资源过度消耗。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-44432
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-44432
请登录查看更多情报信息。
- https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63jx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-44432
IV. Related Vulnerabilities
Same product: urllib3
- CVE-2026-44431
urllib3: Sensitive headers forwarded across origins in proxi - CVE-2026-21441
urllib3 vulnerable to decompression-bomb safeguard bypass wh - CVE-2025-66471
urllib3 Streaming API improperly handles highly compressed d - CVE-2025-66418
urllib3 allows an unbounded number of links in the decompres - CVE-2025-50182
urllib3 does not control redirects in browsers and Node.js
Same vendor: urllib3
- CVE-2026-44431
urllib3: Sensitive headers forwarded across origins in proxi - CVE-2026-21441
urllib3 vulnerable to decompression-bomb safeguard bypass wh - CVE-2025-66471
urllib3 Streaming API improperly handles highly compressed d - CVE-2025-66418
urllib3 allows an unbounded number of links in the decompres - CVE-2025-50182
urllib3 does not control redirects in browsers and Node.js
Same weakness: CWE-409
- CVE-2026-43970
Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhau - CVE-2026-42886
Audiobookshelf: Memory amplification DoS via oversized compr - CVE-2026-27460
Tandoor Recipes Affected by Denial of Service via Recipe Imp - CVE-2026-40148
PraisonAI Affected by Decompression Bomb DoS via Recipe Bund - CVE-2026-39373
JWCrypto: JWE ZIP decompression bomb
V. Comments for CVE-2026-44432
No comments yet