THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-44432 (HIGH 7.5) — urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) w

[NVD] CVE-2026-44432 (HIGH 7.5) — urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) w

lownvdPublished 2026-05-13

CVE-2026-44432 CVSS: 7.5 HIGH Published: 2026-05-13T16:16:57.303

urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the res

MITRE ATT&CK techniques

CompressionT1027.015

Indicators of compromise

CVE-2026-44432cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-44432