Improper handling of highly compressed data in urllib3 - CVE-2026-44432

Vulnerability identifier: #VU130906

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-44432

CWE-ID: CWE-409

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of highly compressed data in the urllib3 streaming API when processing compressed HTTP responses from untrusted sources. A remote attacker can send a highly compressed response to cause a denial of service.

Exploitation requires either incremental reads of a Brotli-encoded response with at least two read or stream calls while using the official Brotli library, or calling HTTPResponse.drain_conn() after decompression has already started.

urllib3
IBM Cloud Pak for Data System
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Maximo Application Suite
IBM Maximo Application Suite - Manage Component
Python for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Ubuntu
Maximo Application Suite - Location Service for Esri Component
Maximo Application Suite - Visual Inspection Component
StreamSets SDK for Python
python-urllib3 (Ubuntu package)
python-urllib3 (Red Hat package)
python3.12-urllib3 (Red Hat package)
python3.14-urllib3 (Red Hat package)

Install security update from vendor's website.

urllib3 - update to 2.7.0
IBM Cloud Pak for Data System - update to 8.10.26.06.SP2
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.4.0 Patch 3
Python for Scientific Computing - update to 4.3.2
Maximo Application Suite - Location Service for Esri Component - addressed in versions 9.0.10, 9.1.9
IBM Maximo Application Suite - addressed in versions 9.0.27, 9.1.19
Maximo Application Suite - Visual Inspection Component - addressed in versions 9.0.21, 9.1.19
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.27, 9.1.19
python-urllib3 (Ubuntu package) - addressed in versions 1.26.5-1~exp1ubuntu0.7, 2.0.7-1ubuntu0.7, 2.3.0-3ubuntu0.6, 2.6.3-1ubuntu1.1
python-urllib3 (Red Hat package) - addressed in versions 1.26.5-8.el9_8, 1.26.19-4.el10_2
python3.12-urllib3 (Red Hat package) - addressed in versions 1.26.19-3.el8_10, 1.26.19-3.el9_8
python3.14-urllib3 (Red Hat package) - update to 2.6.3-2.el10_2
StreamSets SDK for Python - update to 7.0.2

• https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j

• Multiple vulnerabilities in urllib3
• Multiple vulnerabilities in IBM Maximo Application Suite - Location Service for Esri Component
• Ubuntu update for python-urllib3
• Red Hat Enterprise Linux 10 update for python3.14-urllib3
• Red Hat Enterprise Linux 10 update for python-urllib3
• Red Hat Enterprise Linux 9 update for python-urllib3
• Red Hat Enterprise Linux 9 update for python3.12-urllib3
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• Red Hat Enterprise Linux 8 update for python3.12-urllib3
• Multiple vulnerabilities in IBM Maximo Application Suite - Visual Inspection Component
• Multiple vulnerabilities in IBM Maximo Application Suite
• Splunk Python for Scientific Computing update for third-party components
• Multiple vulnerabilities in IBM Cloud Pak for Data System
• Multiple vulnerabilities in IBM StreamSets SDK for Python
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge