Skip to content
Threat Feed

Product

Urllib3 (>= 2.6.0, < 2.7.0)

1 brief RSS
medium advisory

Urllib3 Decompression Bomb Vulnerability in Streaming API (CVE-2026-44432)

Urllib3 versions before 2.7.0 are vulnerable to excessive resource consumption when using the streaming API to decompress responses, particularly when using the Brotli library or calling HTTPResponse.drain_conn() after partial decompression, leading to high CPU usage and memory allocation, potentially causing a denial-of-service condition (CVE-2026-44432).

urllib3 decompression-bomb denial-of-service vulnerability
2r 1t