CVE-2026-44432
HighAdvisory
Published 11 May 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.9
- base score, highest
- EPSS
- 0.007
- 50th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 330
- of 17,781 indexed, latest versions
- Container images
- 206
- deployed by those charts
- Fix available
- 2 of 3
- affected packages
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
Carried by container images the latest versions of 330 of 17,781 indexed charts deploy, on 206 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| py3-pipapk | 25.0.1-r0, 25.2-r0, 26.0.1-r1 | 26.1.2-r1 | 3 |
| python-pipdeb | 1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+22 more | no fix listed | 107 |
| urllib3pypi | 2.6.0, 2.6.1, 2.6.2, 2.6.3 | 2.7.0 | 99 |
- OSV records
- CGA-63m6-2q77-9p47CGA-7w5f-j6gp-9573GHSA-mf9v-mfxr-j63jUBUNTU-CVE-2026-44432
- Also known as
- CGA-9f85-qpfh-pwpj, CGA-g9cf-jc7j-hpwm, PYSEC-2026-142
Charts affected
330 by stars
Container images carrying it
206 by charts deploying them
A fixed version is listed for 2 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| galaxy/ | 0267bad550e6 | python-pip | no fix listed | 1 |
| galaxy/ | 8e577a626dfd | python-pip | no fix listed | 1 |
| geonode/ | 81b1d431b7e9 | python-pip | no fix listed | 1 |
| geopython/ | 84662ea6b78b | urllib3 | 2.7.0 | 1 |
| geoscienceaustralia/ | f4039b45572a | python-pip | no fix listed | 1 |
| gethue/ | 11b649636e68 | python-pip | no fix listed | 1 |
| gethue/ | 5702b2c37ff9 | python-pip | no fix listed | 1 |
| gethue/ | 7d5c1b9f8a79 | python-pip urllib3 | no fix listed 2.7.0 | 1 |
| heartexlabs/ | aa461572e8f9 | urllib3 | 2.7.0 | 1 |
| helicone/ | 4c69b971a7e4 | python-pip | no fix listed | 1 |
| helmforge/ | 61f759a1421f | urllib3 | 2.7.0 | 1 |
| helmforge/ | fcb7017327d6 | urllib3 | 2.7.0 | 1 |
| intel/ | aa8f5483a2ef | python-pip | no fix listed | 1 |
| intelowlproject/ | 0b22e547ea6b | urllib3 | 2.7.0 | 1 |
| jonasal/ | ec1eee99a18d | urllib3 | 2.7.0 | 1 |
| josh5/ | 4d49c4816260 | python-pip | no fix listed | 1 |
| jupyterhub/ | 3974ba945e65 | python-pip | no fix listed | 1 |
| jupyterhub/ | b6b4a1a34bf0 | python-pip | no fix listed | 1 |
| jupyterhub/ | e4770285aaf7 | python-pip | no fix listed | 1 |
| jupyterjsc/ | aea53b13f235 | urllib3 | 2.7.0 | 1 |
| kenchrcum/ | 12fb213debf1 | urllib3 | 2.7.0 | 1 |
| kenchrcum/ | c326e28a8f5f | urllib3 | 2.7.0 | 1 |
| kenchrcum/ | 5310497aea3f | urllib3 | 2.7.0 | 1 |
| kenchrcum/ | 84dae7aeea5b | urllib3 | 2.7.0 | 1 |
| kenchrcum/ | ce657c622ce5 | urllib3 | 2.7.0 | 1 |
| kennethreitz/ | 599fe5e50731 | python-pip | no fix listed | 1 |
| knspar/ | 09499d2dc91a | python-pip | no fix listed | 1 |
| kong/ | a6ac46531193 | python-pip | no fix listed | 1 |
| kusionstack/ | 126c8f0b0976 | python-pip | no fix listed | 1 |
| langgenius/ | 3c694329357b | python-pip | no fix listed | 1 |
| langgenius/ | 8269050f192e | python-pip urllib3 | no fix listed 2.7.0 | 1 |
| langgenius/ | da995c129e2f | python-pip | no fix listed | 1 |
| langgenius/ | 750e1111426e | urllib3 | 2.7.0 | 1 |
| library/ | 3466ba4a4828 | urllib3 | 2.7.0 | 1 |
| library/ | 85b9bf2e29cf | urllib3 | 2.7.0 | 1 |
| library/ | 8dbcf531a03a | urllib3 | 2.7.0 | 1 |
| linuxserver/ | 241009026e6f | python-pip | no fix listed | 1 |
| litellm/ | 09b217802ded | py3-pip urllib3 | 26.1.2-r1 2.7.0 | 1 |
| loeken/ | 7efbc24e47b0 | urllib3 | 2.7.0 | 1 |
| lsstsqre/ | b75bf8aaafa4 | python-pip | no fix listed | 1 |
| marcoimme/ | b6035c0721a8 | urllib3 | 2.7.0 | 1 |
| mawad98/ | 99422c56a274 | urllib3 | 2.7.0 | 1 |
| mediagis/ | 7923a8e67197 | python-pip | no fix listed | 1 |
| mediagis/ | c15e941485ef | python-pip | no fix listed | 1 |
| mediagis/ | d0eae7b51374 | python-pip | no fix listed | 1 |
| mindsdb/ | 163011c09299 | urllib3 | 2.7.0 | 1 |
| mshanley80/ | 5b189a70c0fb | python-pip | no fix listed | 1 |
| networktocode/ | ed484336b1ad | urllib3 | 2.7.0 | 1 |
| omecproject/ | bcc5f19fd676 | python-pip | no fix listed | 1 |
| omecproject/ | d109a8e57e71 | python-pip | no fix listed | 1 |