StackRadar

CVE-2026-44432

High

Advisory

Published 11 May 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.9
base score, highest
EPSS
0.007
50th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
330
of 17,781 indexed, latest versions
Container images
206
deployed by those charts
Fix available
2 of 3
affected packages

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Carried by container images the latest versions of 330 of 17,781 indexed charts deploy, on 206 images.

Affected packageAffected versionsFixed inImages
py3-pipapk25.0.1-r0, 25.2-r0, 26.0.1-r126.1.2-r13
python-pipdeb1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+22 moreno fix listed107
urllib3pypi2.6.0, 2.6.1, 2.6.2, 2.6.32.7.099
OSV records
CGA-63m6-2q77-9p47CGA-7w5f-j6gp-9573GHSA-mf9v-mfxr-j63jUBUNTU-CVE-2026-44432
Also known as
CGA-9f85-qpfh-pwpj, CGA-g9cf-jc7j-hpwm, PYSEC-2026-142

Charts affected

330 by stars
ChartLatestAffected imagesRadar Score
Practica_4_Recuperacion_helmmca-03-02-practica4-recuperacionVerified publisher1.0.11 of 6See more

Practica_4_Recuperacion_helm mca-03-02-practica4-recuperacion 1.0.1

1 of the 6 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8b3b90af2a655
urllib3@2.6.3
2.7.0

Open the chart page →

19,187
opsopsVerified publisher1.2.02 of 2See more

ops ops 1.2.0

2 of the 2 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
shaowenchen/ops-controller-manager:latest26da43bb5b66
python-pip@22.0.2+dfsg-1ubuntu0.7
no fix listed
shaowenchen/ops-server:latest315444f703f4
python-pip@22.0.2+dfsg-1ubuntu0.6
no fix listed

Open the chart page →

8,939
reportportalreportportal-ioOfficialVerified publisher26.8.121 of 15See more

reportportal reportportal-io 26.8.12

1 of the 15 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
reportportal/service-auto-analyzer:5.15.5c449b93629a5
urllib3@2.6.3
2.7.0

Open the chart page →

11,869
routehub-client-hubroutehub-helm1.0.01 of 3See more

routehub-client-hub routehub-helm 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg16d7db8f1085a3
python-pip@22.0.2+dfsg-1ubuntu0.7
no fix listed

Open the chart page →

12,930
devpisb-helm-charts0.3.01 of 1See more

devpi sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
jonasal/devpi-server:6.17.0-alpineec1eee99a18d
urllib3@2.6.2
2.7.0

Open the chart page →

920
smarter-demosmarterOfficialVerified publisher0.1.52 of 7See more

smarter-demo smarter 0.1.5

2 of the 7 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
ghcr.io/smarter-project/audio-client:v3.1.23c8375dc5487
python-pip@20.0.2-5ubuntu1.6
no fix listed
ghcr.io/smarter-project/image-detector:v2.5.31dcca70c6446
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

45,832
ckanstatcan0.0.351 of 8See more

ckan statcan 0.0.35

1 of the 8 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
statcan/ckan:2.93921305425b8
python-pip@20.0.2-5ubuntu1.5
no fix listed

Open the chart page →

24,930
tocktock0.6.31 of 9See more

tock tock 0.6.3

1 of the 9 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
urllib3@2.6.3
2.7.0

Open the chart page →

12,907
spark-operatorwikimedia2.2.71 of 1See more

spark-operator wikimedia 2.2.7

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
ghcr.io/kubeflow/spark-operator/controller:2.2.1865ff4da5686
python-pip@20.0.2-5ubuntu1.11
no fix listed

Open the chart page →

7,835
wordpress-e2e-setupwoocommerce-e2e-setup0.1.11 of 2See more

wordpress-e2e-setup woocommerce-e2e-setup 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

7,696
wordpress-helmwordpress-helm0.2.91 of 4See more

wordpress-helm wordpress-helm 0.2.9

1 of the 4 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:885b9bf2e29cf
urllib3@2.6.3
2.7.0

Open the chart page →

8,217
workflows-sinkworkflows-sinkVerified publisher0.16.31 of 1See more

workflows-sink workflows-sink 0.16.3

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
registry.gitlab.com/dyff/workflows-sink:0.16.3564718e28931
urllib3@2.6.3
2.7.0

Open the chart page →

1,397
aeneabotygdrassilOfficialVerified publisher0.2.01 of 2See more

aeneabot ygdrassil 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
elautoestopista/aeneabot:4.2.1125ba620d528
urllib3@2.6.3
2.7.0

Open the chart page →

1,697
youtubedl-materialyoutubedl-materialVerified publisher0.0.11 of 1See more

youtubedl-material youtubedl-material 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:latest2f943d584711
python-pip@22.0.2+dfsg-1ubuntu0.2
no fix listed

Open the chart page →

9,783
qleverzazukoVerified publisher0.7.02 of 2See more

qlever zazuko 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
ghcr.io/zazukoians/qlever-server:v0.10.0f10fd24b2290
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed
ghcr.io/zazukoians/qlever-ui:v0.10.034c7b540a095
urllib3@2.6.3
2.7.0

Open the chart page →

2,900
acos-prometheus-exporter-helm-charta10-prometheus-exporter0.1.01 of 1See more

acos-prometheus-exporter-helm-chart a10-prometheus-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
a10networks/acos-prometheus-exporter:latest8dc58d434d71
python-pip@9.0.1-2.3~ubuntu1.18.04.1
no fix listed

Open the chart page →

12,007
open5gsadaptivenetlabVerified publisher1.0.31 of 3See more

open5gs adaptivenetlab 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
python-pip@20.0.2-5ubuntu1.1
no fix listed

Open the chart page →

25,443
browserlessalekcVerified publisher1.2.71 of 1See more

browserless alekc 1.2.7

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
ghcr.io/browserless/chrome:v2.56.7d600eac6283f
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed

Open the chart page →

2,078
pagesalstom-pages-app1.0.01 of 3See more

pages alstom-pages-app 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagesandrei-pages1.0.01 of 3See more

pages andrei-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
ansible-inspecansible-inspec0.2.171 of 2See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
urllib3@2.6.3
2.7.0

Open the chart page →

5,558
ansible-playbook-operatoransible-playbook-operatorVerified publisher0.1.71 of 1See more

ansible-playbook-operator ansible-playbook-operator 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
kenchrcum/ansible-playbook-operator:0.1.712fb213debf1
urllib3@2.6.3
2.7.0

Open the chart page →

1,339
pgadminappscodeVerified publisher2026.3.301 of 1See more

pgadmin appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.11.050700ac17936
urllib3@2.6.1
2.7.0

Open the chart page →

1,565
appwriteappwrite-helmVerified publisher1.3.21 of 8See more

appwrite appwrite-helm 1.3.2

1 of the 8 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
appwrite/appwrite:1.9.01aaa70127114
urllib3@2.6.3
2.7.0

Open the chart page →

9,847
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
assistiot/open_api_backend:1.1.230812ba93555
python-pip@22.0.2+dfsg-1ubuntu0.4
no fix listed

Open the chart page →

18,277
videoaugmentationassist-iot-video-augmentation0.1.01 of 3See more

videoaugmentation assist-iot-video-augmentation 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
assistiot/video_augmentation:runner-cpu-lateste5ae539ce2cb
python-pip@20.0.2-5ubuntu1.8
no fix listed

Open the chart page →

13,913
backstage-pyactionsbackstage-pyactionsVerified publisher0.1.01 of 1See more

backstage-pyactions backstage-pyactions 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
mawad98/backstage-pyactions:demo99422c56a274
urllib3@2.6.3
2.7.0

Open the chart page →

2,738
helm-samplebehnambm-helm-chart1.0.11 of 3See more

helm-sample behnambm-helm-chart 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8b3b90af2a655
urllib3@2.6.3
2.7.0

Open the chart page →

2,727
pagesberrutig-pages1.0.01 of 3See more

pages berrutig-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
mx-nodebicarus-labs0.1.01 of 1See more

mx-node bicarus-labs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
bicarus/elrond-rosetta:v1.3.50.0b1dab0721e1c
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

7,956
huebigdata-chartsVerified publisher1.0.41 of 2See more

hue bigdata-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
gethue/hue:4.10.05702b2c37ff9
python-pip@9.0.1-2.3~ubuntu1.18.04.5
no fix listed

Open the chart page →

22,891
pagesbrian-pages1.0.01 of 3See more

pages brian-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagesbrixton-mayuribhavsar23-pages1.0.01 of 3See more

pages brixton-mayuribhavsar23-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagesbrixton-pages1.0.01 of 3See more

pages brixton-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagescamden-pages1.0.01 of 3See more

pages camden-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagescarina-pages1.0.01 of 3See more

pages carina-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagescarmel-pages-dell1.0.01 of 3See more

pages carmel-pages-dell 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
castai-hibernatecastaiVerified publisher0.2.121 of 1See more

castai-hibernate castai 0.2.12

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
castai/hibernate:v0.14da62858c8381
urllib3@2.6.3
2.7.0

Open the chart page →

1,146
chart-appchart-app0.3.01 of 2See more

chart-app chart-app 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8b3b90af2a655
urllib3@2.6.3
2.7.0

Open the chart page →

1,775
chart-dnazarenochart-dnazareno0.1.01 of 3See more

chart-dnazareno chart-dnazareno 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8b3b90af2a655
urllib3@2.6.3
2.7.0

Open the chart page →

5,778
kitchenowlchart-kitchenowl0.1.121 of 2See more

kitchenowl chart-kitchenowl 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
tombursch/kitchenowl-backend:v0.7.8b48e4ab727cd
urllib3@2.6.3
2.7.0

Open the chart page →

4,803
kube-acp-stackcloudentity2.28.01 of 7See more

kube-acp-stack cloudentity 2.28.0

1 of the 7 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
python-pip@22.0.2+dfsg-1ubuntu0.5
no fix listed

Open the chart page →

20,900
webpagetest-agentcloudnativeapp0.2.01 of 1See more

webpagetest-agent cloudnativeapp 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
python-pip@8.1.1-2ubuntu0.4
no fix listed

Open the chart page →

77,758
cloudlaunchcloudve0.6.01 of 5See more

cloudlaunch cloudve 0.6.0

1 of the 5 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

12,457
cloudlaunch-servercloudve0.2.01 of 5See more

cloudlaunch-server cloudve 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

12,131
cloudlaunchservercloudve0.6.01 of 4See more

cloudlaunchserver cloudve 0.6.0

1 of the 4 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

11,592
galaxykubemancloudve2.10.11 of 7See more

galaxykubeman cloudve 2.10.1

1 of the 7 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
galaxy/cloudman-server:lateste5c265fe9fcd
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

16,069
galaxy-stablecloudve2.0.02 of 5See more

galaxy-stable cloudve 2.0.0

2 of the 5 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
galaxy/galaxy-init:v18.010267bad550e6
python-pip@1.5.4-1ubuntu4
no fix listed
galaxy/galaxy-stable:v18.018e577a626dfd
python-pip@1.5.4-1ubuntu4
no fix listed

Open the chart page →

70,895
janisterminalcloudve0.1.01 of 2See more

janisterminal cloudve 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
cloudve/janis-terminal:latestaf56e77ca587
python-pip@9.0.1-2.3~ubuntu1.18.04.1
no fix listed

Open the chart page →

14,270
argo-cdcluster-deploy0.3.21 of 3See more

argo-cd cluster-deploy 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-image-updater:v1.2.13c56f354fac5
urllib3@2.6.3
2.7.0

Open the chart page →

3,693

Container images carrying it

206 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
urllib3@2.6.2
2.7.0
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
urllib3@2.6.2
2.7.0
1
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed
1
registry.gitlab.com/dyff/workflows-sink:0.16.3564718e28931
urllib3@2.6.3
2.7.0
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
python-pip@20.0.2-5ubuntu1.1
no fix listed
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
urllib3@2.6.2
2.7.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.