urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API (urllib3 urllib3)

CVE-2026-44432

HIGH 8.9

En bref

Source: NVD
EPSS: EPSS 0.68 % · centile 52 (2026-10-29)
État: PUBLISHED
Publiée: 2026-05-13 15:17 UTC
Mise à jour: 2026-09-10 12:04 UTC
Attribuée par: GitHub_M
Statut NVD: Modified

Rechercher sur…

Description

urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.

Faiblesses (CWE)

CWE-409 — Gestion incorrecte de données fortement compressées (bombe zip)

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 4.0	HIGH 8.9	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H	GitHub_M
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	redhat-SADP
CVSS 4.0	HIGH 8.9	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

Avis

GHSA-mf9v-mfxr-j63j — urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
PYSEC-2026-142 — urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) durin

Références européennes

ENISA EUVD · EUVD-2026-30047
GCVE · GCVE-0-2026-44432

Avis du CERT-FR

CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2026-AVI-1378 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1206 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1032 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0834 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0698 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* ≥ 2.6.0 < 2.7.0

Produits affectés

Produit	Versions
urllib3 · urllib3	affected >= 2.6.0, < 2.7.0

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API (urllib3 urllib3)