CVE-2026-44432
HighAdvisory
Published 11 May 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.9
- base score, highest
- EPSS
- 0.007
- 50th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 330
- of 17,781 indexed, latest versions
- Container images
- 206
- deployed by those charts
- Fix available
- 2 of 3
- affected packages
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
Carried by container images the latest versions of 330 of 17,781 indexed charts deploy, on 206 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| py3-pipapk | 25.0.1-r0, 25.2-r0, 26.0.1-r1 | 26.1.2-r1 | 3 |
| python-pipdeb | 1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+22 more | no fix listed | 107 |
| urllib3pypi | 2.6.0, 2.6.1, 2.6.2, 2.6.3 | 2.7.0 | 99 |
- OSV records
- CGA-63m6-2q77-9p47CGA-7w5f-j6gp-9573GHSA-mf9v-mfxr-j63jUBUNTU-CVE-2026-44432
- Also known as
- CGA-9f85-qpfh-pwpj, CGA-g9cf-jc7j-hpwm, PYSEC-2026-142
Charts affected
330 by stars
Container images carrying it
206 by charts deploying them
A fixed version is listed for 2 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| opencsghq/ | af7191a9cf8a | urllib3 | 2.7.0 | 1 |
| opencsghq/ | 47e22aa71870 | urllib3 | 2.7.0 | 1 |
| opencsghq/ | b4e849fcf94a | urllib3 | 2.7.0 | 1 |
| opendatacube/ | 5d810e8504b8 | python-pip | no fix listed | 1 |
| opendatacube/ | 91870111837c | python-pip | no fix listed | 1 |
| opendatacube/ | 1b90cdf68831 | python-pip | no fix listed | 1 |
| openelevation/ | 82fb21612e86 | python-pip | no fix listed | 1 |
| openmined/ | b72f74a68b32 | py3-pip | 26.1.2-r1 | 1 |
| openwhisk/ | c80dba0de3aa | python-pip | no fix listed | 1 |
| prompve/ | e3d501a82df5 | urllib3 | 2.7.0 | 1 |
| redash/ | c5c9148f5c38 | urllib3 | 2.7.0 | 1 |
| reportportal/ | c449b93629a5 | urllib3 | 2.7.0 | 1 |
| rezachalak/ | 34f694325191 | python-pip | no fix listed | 1 |
| scrapinghub/ | a5f89bc84606 | python-pip | no fix listed | 1 |
| seafileltd/ | 6693911bcc40 | python-pip | no fix listed | 1 |
| seafileltd/ | 70628f29c663 | python-pip | no fix listed | 1 |
| seafileltd/ | 7ac833196f60 | python-pip | no fix listed | 1 |
| seafileltd/ | d0c66e4621bd | python-pip | no fix listed | 1 |
| seafileltd/ | ed0fcda5e6a9 | python-pip | no fix listed | 1 |
| seldonio/ | 1d0da98a2d76 | python-pip | no fix listed | 1 |
| shaowenchen/ | 26da43bb5b66 | python-pip | no fix listed | 1 |
| shaowenchen/ | 315444f703f4 | python-pip | no fix listed | 1 |
| socialmediamacroscope/ | 70fb11d4f531 | python-pip | no fix listed | 1 |
| socialmediamacroscope/ | 19d3d26d53ee | python-pip | no fix listed | 1 |
| socialmediamacroscope/ | f508216be63c | python-pip | no fix listed | 1 |
| someblackmagic/ | 6eca64b6b440 | python-pip | no fix listed | 1 |
| stashapp/ | df744af5a0c9 | urllib3 | 2.7.0 | 1 |
| statcan/ | 3921305425b8 | python-pip | no fix listed | 1 |
| streamnative/ | 11bceacec8fb | python-pip | no fix listed | 1 |
| timescale/ | d7db8f1085a3 | python-pip | no fix listed | 1 |
| timescale/ | e8d0a9cc3db5 | python-pip | no fix listed | 1 |
| timothyclarke/ | 22c41e5ca7e2 | python-pip | no fix listed | 1 |
| tinymediamanager/ | 2b34dc85099e | urllib3 | 2.7.0 | 1 |
| tock/ | abf7880e0449 | urllib3 | 2.7.0 | 1 |
| tombursch/ | b48e4ab727cd | urllib3 | 2.7.0 | 1 |
| tomsquest/ | a594c624c5a6 | urllib3 | 2.7.0 | 1 |
| tussanakorndev/ | 216fdadadf9a | urllib3 | 2.7.0 | 1 |
| voltha/ | c4e41e92f046 | python-pip | no fix listed | 1 |
| voltha/ | 37f80524c207 | python-pip | no fix listed | 1 |
| voltha/ | 9ee8c1f4428c | python-pip | no fix listed | 1 |
| voltha/ | 655c3048a602 | python-pip | no fix listed | 1 |
| voltha/ | ff596b62de59 | python-pip | no fix listed | 1 |
| wallarm/ | aecd88b24c51 | urllib3 | 2.7.0 | 1 |
| wazuh/ | 5a065930682d | urllib3 | 2.7.0 | 1 |
| wazuh/ | f09282d281f6 | urllib3 | 2.7.0 | 1 |
| xeladock/ | 4baf531453f1 | python-pip | no fix listed | 1 |
| ghcr.io/ | 49c972229c6b | urllib3 | 2.7.0 | 1 |
| ghcr.io/ | ab63d26a8a2c | py3-pip | 26.1.2-r1 | 1 |
| ghcr.io/ | d600eac6283f | python-pip | no fix listed | 1 |
| ghcr.io/ | 2ed0183564d7 | python-pip | no fix listed | 1 |