Read the docs
TI-2026-32373 Aliases CVE-2026-44432GHSA-mf9v-mfxr-j63j

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Priority MEDIUM 40CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 42 fixed, 5 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0068 52nd percentileScored 2026-11-07
Fix Partial urllib3 (urllib3): 2.7.0urllib3 (PyPI): 2.7.0Red Hat: 89 advisoriesRed Hat: 42 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
python-pillowurllib32.6.0 to before 2.7.02.7.0Patch availableCNA
—urllib3 (PyPI)2.6.0 to before 2.7.02.7.0Patch availableGHSA-mf9v-mfxr-j63j
  • urllib3 Vendorpython-pillow Affected 2.6.0 to before 2.7.0 Fixed in 2.7.0 Patch available CNA
  • urllib3 (PyPI) Vendor— Affected 2.6.0 to before 2.7.0 Fixed in 2.7.0 Patch available GHSA-mf9v-mfxr-j63j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*2.6.0 to before 2.7.0Vulnerablepython-pillow
  • cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* Versions 2.6.0 to before 2.7.0 Vulnerable ·python-pillow

Remediation

  • Fix · CNA urllib3 (urllib3) Fixed in 2.7.0
  • Fix · GHSA-mf9v-mfxr-j63j urllib3 (PyPI) Fixed in 2.7.0 Advisory →

Red Hat 89 advisories

  • RHSA-2026:92281 Released 2026-11-04 · Red Hat rating Important
    OpenShift Container Platform 4.19.54 security and extras update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9-operator
  • RHSA-2026:92284 Released 2026-11-03 · Red Hat rating Important
    OpenShift Container Platform 4.20.45 security and extras update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9-operator, registry.redhat.io/openshift4/ose-ptp-rhel9-operator
  • RHSA-2026:92452 Released 2026-10-29 · Red Hat rating Critical
    Red Hat Enterprise Linux AI 3.5.2 enhancement update
    • Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
Show 86 more Red Hat advisories
  • RHSA-2026:92449 Released 2026-10-29 · Red Hat rating Critical
    Red Hat Enterprise Linux AI 3.5.2 enhancement update
    • Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:83703 Released 2026-10-20 · Red Hat rating Important
    OpenShift Container Platform 4.21.39 security and extras update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-cluster-capacity-rhel9 +6
  • RHSA-2026:82415 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (cpu)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:82371 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (spyre)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-spyre-rhel9
  • RHSA-2026:82368 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (cuda)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:82066 Released 2026-10-13 · Red Hat rating Important
    Red Hat AI Inference Model Optimization Tools 3.5.2 (CUDA)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/model-opt-cuda-rhel9
  • RHSA-2026:82061 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference Tech Preview 3.5.2 (Gaudi)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-gaudi-rhel9
  • RHSA-2026:82059 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (ROCm)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-rocm-rhel9
  • RHSA-2026:74674 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:74463 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (ROCm 7.0)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:74462 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (CUDA 12.9)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:74461 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (Spyre)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:74460 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (CPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:74459 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (ROCm 6.4)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:74458 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (TPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:73962 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (cuda)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:73961 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (spyre)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:73960 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (cpu)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:73959 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (tpu)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:73930 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (rocm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:73929 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (cuda)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:73909 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (rocm)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:73859 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:70267 Released 2026-09-22 · Red Hat rating Important
    Red Hat Quay 3.14.9
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:60371 Released 2026-08-26 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.4) python-urllib3-1.26.5-5.el9_4.4, python3-urllib3-1.26.5-5.el9_4.4
  • RHSA-2026:60362 Released 2026-08-26 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) python-urllib3-1.26.5-3.el9_2.4, python3-urllib3-1.26.5-3.el9_2.4
  • RHSA-2026:59409 Released 2026-08-25 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) python-urllib3-1.26.5-6.el9_6.2, python3-urllib3-1.26.5-6.el9_6.2
  • RHSA-2026:58981 Released 2026-08-24 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.3 Technology Preview security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-tp-rhel9, registry.redhat.io/rhui5/installer-tp-rhel9, registry.redhat.io/rhui5/rhua-tp-rhel9
  • RHSA-2026:56347 Released 2026-08-18 · Red Hat rating Important
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-analyzer-addon-rhel9, registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-discovery-addon-rhel9 +4
  • RHSA-2026:54395 Released 2026-08-12 · Red Hat rating Important
    Red Hat Quay 3.17.4
    • Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:51206 Released 2026-08-06 · Red Hat rating Important
    General availability of the satellite/iop-advisor-backend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-advisor-backend-rhel9
  • RHSA-2026:44481 Released 2026-07-23 · Red Hat rating Important
    Red Hat Update Infrastructure 5.2 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:43038 Released 2026-07-21 · Red Hat rating Critical
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-solution-server-rhel9
  • RHSA-2026:42796 Released 2026-07-21 · Red Hat rating Important
    Red Hat Quay 3.15.6
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:42644 Released 2026-07-21 · Red Hat rating Important
    RHOAI 2.25.9 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-feature-server-rhel9, registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9 +36
  • RHSA-2026:42144 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8 +1
  • RHSA-2026:42132 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
  • RHSA-2026:42079 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 ansible-core-2:2.16.19-1.el10ap, receptor-1.6.6-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, automation-controller-venv-tower-4.7.14-3.el9ap, automation-gateway-proxy-2.6.17-1.el9ap +5
  • RHSA-2026:42078 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-core-1:2.16.19-1.el8ap, ansible-test-1:2.16.19-1.el8ap, automation-controller-4.6.30-2.el8ap +24
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, ansible-test-1:2.16.19-1.el9ap, automation-controller-4.6.30-2.el9ap +24
  • RHSA-2026:41066 Released 2026-07-16 · Red Hat rating Important
    Red Hat Quay 3.16.5
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:37275 Released 2026-07-09 · Red Hat rating Critical
    RHOAI 3.3.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9, registry.redhat.io/rhoai/odh-feast-operator-rhel9 +45
  • RHSA-2026:36350 Released 2026-07-07 · Red Hat rating Important
    satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/foreman-mcp-server-rhel9
  • RHSA-2026:34607 Released 2026-07-01 · Red Hat rating Important
    General availability of the satellite/iop-insights-engine-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-insights-engine-rhel9
  • RHSA-2026:34533 Released 2026-07-01 · Red Hat rating Important
    General availability of the satellite/iop-yuptoo-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-yuptoo-rhel9
  • RHSA-2026:34531 Released 2026-07-01 · Red Hat rating Important
    General availability of the satellite/iop-puptoo-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-puptoo-rhel9
  • RHSA-2026:34526 Released 2026-07-01 · Red Hat rating Important
    Technical preview of the satellite/iop-vmaas-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vmaas-rhel9
  • RHSA-2026:34374 Released 2026-07-01 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +5
  • RHSA-2026:34160 Released 2026-07-01 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.13-2.el9ap, automation-controller-cli-4.7.13-2.el9ap, automation-controller-server-4.7.13-2.el9ap +7
  • RHSA-2026:33683 Released 2026-06-30 · Red Hat rating Important
    Red Hat Quay 3.10.23
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:33313 Released 2026-06-29 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:32992 Released 2026-06-29 · Red Hat rating Important
    python3.12-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.12-urllib3-1.26.19-3.el8_10
  • RHSA-2026:30089 Released 2026-06-25 · Red Hat rating Critical
    Red Hat AI Inference Server 3.3.5 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:30088 Released 2026-06-25 · Red Hat rating Critical
    Red Hat AI Inference Server 3.3.5 (ROCm)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:30087 Released 2026-06-25 · Red Hat rating Critical
    Red Hat AI Inference Server 3.3.5 (Spyre)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-spyre-rhel9
  • RHSA-2026:30078 Released 2026-06-25 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.3.5 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:30076 Released 2026-06-25 · Red Hat rating Important
    Red Hat Quay 3.12.19
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:28571 Released 2026-06-23 · Red Hat rating Important
    Red Hat Quay 3.9.23
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:28157 Released 2026-06-23 · Red Hat rating Important
    python3.14-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.14-urllib3-2.6.3-2.el9_8
  • RHSA-2026:28159 Released 2026-06-23 · Red Hat rating Important
    python3.12-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.12-urllib3-1.26.19-3.el9_8
  • RHSA-2026:28158 Released 2026-06-23 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS (v. 9) python-urllib3-1.26.5-8.el9_8, python3-urllib3-1.26.5-8.el9_8
  • RHSA-2026:28000 Released 2026-06-22 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS (v. 10) python-urllib3-1.26.19-4.el10_2, python3-urllib3-1.26.19-4.el10_2
  • RHSA-2026:27929 Released 2026-06-22 · Red Hat rating Important
    python3.14-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 10) python3.14-urllib3-2.6.3-2.el10_2
  • RHSA-2026:26304 Released 2026-06-16 · Red Hat rating Important
    General availability of the satellite/iop-insights-engine-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-insights-engine-rhel9
  • RHSA-2026:26212 Released 2026-06-16 · Red Hat rating Important
    General availability of the satellite/iop-puptoo-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-puptoo-rhel9
  • RHSA-2026:26068 Released 2026-06-15 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:25928 Released 2026-06-15 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-27/hub-rhel9 +3
  • RHSA-2026:25143 Released 2026-06-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images mariadb-11.8.8-1.hum1@aarch64, mariadb-11.8.8-1.hum1@x86_64, mariadb-backup-11.8.8-1.hum1@aarch64 +37
  • RHSA-2026:25039 Released 2026-06-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images jaeger-2.19.0-1.hum1@aarch64, jaeger-2.19.0-1.hum1@src, jaeger-2.19.0-1.hum1@x86_64
  • RHSA-2026:24544 Released 2026-06-08 · Red Hat rating Important
    Red Hat AI Inference 3.4.1 (cuda)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:24542 Released 2026-06-08 · Red Hat rating Important
    Red Hat AI Inference Model Optimization Tools 3.4.1 (cuda)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/model-opt-cuda-rhel9
  • RHSA-2026:24541 Released 2026-06-08 · Red Hat rating Important
    Red Hat AI Inference 3.4.1 (spyre)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-spyre-rhel9
  • RHSA-2026:24540 Released 2026-06-08 · Red Hat rating Important
    Red Hat AI Inference 3.4.1 (cpu)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:24483 Released 2026-06-08 · Red Hat rating Important
    RHTAS 1.4 - GA Release of Model Transparency 1.0.1
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/model-transparency-rhel9
  • RHSA-2026:24476 Released 2026-06-08 · Red Hat rating Important
    RHTAS 1.3.5 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/segment-reporting-rhel9
  • RHSA-2026:24374 Released 2026-06-08 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python-rpds-py-2026.5.1-1.hum1@src, python3-rpds-py-2026.5.1-1.hum1@aarch64, python3-rpds-py-2026.5.1-1.hum1@x86_64
  • RHSA-2026:24069 Released 2026-06-07 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images clang21-21.1.8-6.hum1@aarch64, clang21-21.1.8-6.hum1@x86_64, clang21-analyzer-21.1.8-6.hum1@aarch64 +47
  • RHSA-2026:24014 Released 2026-06-07 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python-cryptography-48.0.0-3.hum1@src, python3-cryptography-48.0.0-3.hum1@aarch64, python3-cryptography-48.0.0-3.hum1@x86_64
  • RHSA-2026:24009 Released 2026-06-07 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python-urllib3-2.7.0-3.hum1@src, python3-urllib3+brotli-2.7.0-3.hum1@noarch@public-hummingbird-aarch64-rpms, python3-urllib3+brotli-2.7.0-3.hum1@noarch@public-hummingbird-x86_64-rpms +8
  • RHSA-2026:24000 Released 2026-06-07 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python-trustme-1.2.1-2.hum1@src, python-trustme-doc-1.2.1-2.hum1@noarch@public-hummingbird-aarch64-rpms, python-trustme-doc-1.2.1-2.hum1@noarch@public-hummingbird-x86_64-rpms +2
  • RHSA-2026:22934 Released 2026-06-03 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images cargo-1.96.0-1.hum1@aarch64, cargo-1.96.0-1.hum1@x86_64, clippy-1.96.0-1.hum1@aarch64 +32
  • RHSA-2026:20338 Released 2026-05-21 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:15862 Released 2026-05-09 · Red Hat rating Critical
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images trivy-0.69.3-1.2.hum1@aarch64, trivy-0.69.3-1.2.hum1@src, trivy-0.69.3-1.2.hum1@x86_64
  • RHSA-2026:7634 Released 2026-04-11 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images clang-21.1.8-1.1.hum1@aarch64, clang-21.1.8-1.1.hum1@x86_64, clang-analyzer-21.1.8-1.1.hum1@aarch64 +47
  • RHSA-2026:7625 Released 2026-04-11 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python-sentry-sdk-2.48.0-4.1.hum1@src, python3-sentry-sdk+aiohttp-2.48.0-4.1.hum1@noarch@public-hummingbird-aarch64-rpms, python3-sentry-sdk+aiohttp-2.48.0-4.1.hum1@noarch@public-hummingbird-x86_64-rpms +34

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift LightspeedAffectedNo fix yet
Pen Drive Powered by Red Hat LightspeedAffectedNo fix planned: Will not fix
Red Hat AI Inference ServerAffectedNo fix planned: Will not fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat AI Inference Server 3.2Fixed RHSA-2026:73859, RHSA-2026:73929, RHSA-2026:73930
Red Hat AI Inference Server 3.3Fixed RHSA-2026:30078, RHSA-2026:30087, RHSA-2026:30088, RHSA-2026:30089
Red Hat AI Inference Server 3.4Fixed RHSA-2026:24540, RHSA-2026:24541, RHSA-2026:24542, RHSA-2026:24544
Red Hat AI Inference Server 3.5Fixed RHSA-2026:82059, RHSA-2026:82061, RHSA-2026:82066, RHSA-2026:82368, RHSA-2026:82371, RHSA-2026:82415
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:42144
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:42078
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:42078
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:34374, RHSA-2026:42132
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:34160, RHSA-2026:42079
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:25928
Red Hat Discovery 2Fixed RHSA-2026:20338, RHSA-2026:33313
Red Hat Enterprise Linux AI 3.5Fixed RHSA-2026:92449, RHSA-2026:92452
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:27929
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:32992
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:28157, RHSA-2026:28159
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:28000
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:28158
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:60362
Red Hat Enterprise Linux BaseOS E4S (v.9.4)Fixed RHSA-2026:60371
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:59409
Red Hat Hardened ImagesFixed RHSA-2026:15862, RHSA-2026:22934, RHSA-2026:24000, RHSA-2026:24009, RHSA-2026:24014, RHSA-2026:24069, RHSA-2026:24374, RHSA-2026:25039, RHSA-2026:25143, RHSA-2026:7625, RHSA-2026:7634
Red Hat Migration Toolkit for Applications 8.2Fixed RHSA-2026:43038, RHSA-2026:56347
Red Hat OpenShift AI 2.25Fixed RHSA-2026:42644, RHSA-2026:87410
Red Hat OpenShift AI 3.0Fixed RHSA-2026:73909, RHSA-2026:73959, RHSA-2026:73960, RHSA-2026:73961, RHSA-2026:73962
Red Hat OpenShift AI 3.2Fixed RHSA-2026:74458, RHSA-2026:74459, RHSA-2026:74460, RHSA-2026:74461, RHSA-2026:74462, RHSA-2026:74463
Red Hat OpenShift AI 3.3Fixed RHSA-2026:37275, RHSA-2026:73987
Red Hat OpenShift AI 3.4Fixed RHSA-2026:74674
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:92281
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:92284
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:83703
Red Hat Quay 3.10Fixed RHSA-2026:33683
Red Hat Quay 3.12Fixed RHSA-2026:30076
Red Hat Quay 3.14Fixed RHSA-2026:70267
Red Hat Quay 3.15Fixed RHSA-2026:42796
Red Hat Quay 3.16Fixed RHSA-2026:41066
Red Hat Quay 3.17Fixed RHSA-2026:54395
Red Hat Quay 3.9Fixed RHSA-2026:28571
Red Hat Satellite 6.18Fixed RHSA-2026:26212, RHSA-2026:26304, RHSA-2026:36350
Red Hat Satellite 6.19Fixed RHSA-2026:34526, RHSA-2026:34531, RHSA-2026:34533, RHSA-2026:34607, RHSA-2026:51206
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:24476
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:24483
Red Hat Update Infrastructure 5Fixed RHSA-2026:44481, RHSA-2026:58981
Not affected: 44 products
  • Exploit Intelligence
  • External Secrets Operator for Red Hat OpenShift
  • Migration Toolkit for Containers
  • Migration Toolkit for Virtualization
  • OpenShift Lightspeed
  • OpenShift Service Mesh 3
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Developer Hub 1
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat Migration Toolkit for Applications 8.2
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenStack Platform 17.1
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.17
  • Red Hat Quay 3.9
  • Red Hat Satellite 6
  • Red Hat Update Infrastructure 4 for Cloud Providers
  • Red Hat Update Infrastructure 5
  • Red Hat build of Quarkus Native builder
  • Service Telemetry Framework 1.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44432
  2. 2026-10-03 Alias added: GHSA-mf9v-mfxr-j63j
  3. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  4. 2026-10-13 Fix available: RHSA-2026:82066 · Red Hat
  5. 2026-10-13 Fix available: RHSA-2026:82061 · Red Hat
  6. 2026-10-13 Fix available: RHSA-2026:82059 · Red Hat
  7. 2026-10-13 Fix available: Red Hat AI Inference Server 3.5 · Red Hat
  8. 2026-10-14 Fix available: RHSA-2026:82368 · Red Hat
  9. 2026-10-14 Fix available: RHSA-2026:82415 · Red Hat
  10. 2026-10-14 Fix available: RHSA-2026:82371 · Red Hat
  11. 2026-10-15 Affected versions changed · Red Hat
  12. 2026-10-16 Affected versions changed · Red Hat
  13. 2026-10-20 Fix available: RHSA-2026:83703 · Red Hat
  14. 2026-10-20 Fix available: Red Hat OpenShift Container Platform 4.21 · Red Hat
  15. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  16. 2026-10-23 Affected versions changed · Red Hat
  17. 2026-10-27 Affected versions changed · Red Hat
  18. 2026-10-30 Fix available: RHSA-2026:92452 · Red Hat
  19. 2026-10-30 Fix available: RHSA-2026:92449 · Red Hat
  20. 2026-10-30 Fix available: Red Hat Enterprise Linux AI 3.5 · Red Hat
  21. 2026-11-03 Fix available: RHSA-2026:92284 · Red Hat
  22. 2026-11-03 Fix available: Red Hat OpenShift Container Platform 4.20 · Red Hat
  23. 2026-11-04 Fix available: RHSA-2026:92281 · Red Hat
  24. 2026-11-04 Fix available: Red Hat OpenShift Container Platform 4.19 · Red Hat
  25. 2026-11-06 Fix available: RHSA-2026:42644 · Red Hat

References

Advisory 2

Other 2

  • TI-2026-17326 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVSS 4.0HIGH 8.9
  • TI-2018-14221 urllib3 before version 1.23 does not remove the Authorization HTTP header when following… CVSS 3.0CRITICAL 9.8
  • TI-2025-40854 urllib3 allows an unbounded number of links in the decompression chain CVSS 4.0HIGH 8.9
  • TI-2025-40898 urllib3 Streaming API improperly handles highly compressed data CVSS 4.0HIGH 8.9
  • TI-2021-12905 An issue was discovered in urllib3 before 1.26.5. CVSS 3.1HIGH 7.5
  • TI-2020-05823 The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through… CVSS 3.1HIGH 7.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences