HTTP Client Library Vulnerability in urllib3 Affecting Python Applications
CVE-2026-44432

8.9HIGH

Key Information:

Vendor

Urllib3

Status
Urllib3
Vendor
CVE Published:
13 May 2026

What is CVE-2026-44432?

The urllib3 library, an essential HTTP client for Python, has a vulnerability that affects versions from 2.6.0 to before 2.7.0. This issue allows for excessive resource consumption by potentially decompressing large amounts of data during specific actions—namely, during the second call to HTTPResponse.read(amt=N) when using the Brotli library for decompression or when invoking HTTPResponse.drain_conn() post a partial decompression. This behavior can lead to high CPU usage and significant memory allocation, which can negatively impact application performance. Users are advised to upgrade to version 2.7.0 or later to mitigate this issue.

Affected Version(s)

urllib3 >= 2.6.0, < 2.7.0

References

https://github.com/urllib3/urllib3/security/advisories/GH...
x_refsource_CONFIRM

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.