StackRadar

CVE-2026-44432

High

Advisory

Published 11 May 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.9
base score, highest
EPSS
0.007
50th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
330
of 17,781 indexed, latest versions
Container images
206
deployed by those charts
Fix available
2 of 3
affected packages

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Carried by container images the latest versions of 330 of 17,781 indexed charts deploy, on 206 images.

Affected packageAffected versionsFixed inImages
py3-pipapk25.0.1-r0, 25.2-r0, 26.0.1-r126.1.2-r13
python-pipdeb1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+22 moreno fix listed107
urllib3pypi2.6.0, 2.6.1, 2.6.2, 2.6.32.7.099
OSV records
CGA-63m6-2q77-9p47CGA-7w5f-j6gp-9573GHSA-mf9v-mfxr-j63jUBUNTU-CVE-2026-44432
Also known as
CGA-9f85-qpfh-pwpj, CGA-g9cf-jc7j-hpwm, PYSEC-2026-142

Charts affected

330 by stars
ChartLatestAffected imagesRadar Score
cleanuparrmedia-servarrVerified publisher0.18.01 of 1See more

cleanuparr media-servarr 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
ghcr.io/cleanuparr/cleanuparr:2.10.5c7cd53ad559a
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed

Open the chart page →

1,789
tinymediamanagermedia-servarrVerified publisher1.6.21 of 2See more

tinymediamanager media-servarr 1.6.2

1 of the 2 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
tinymediamanager/tinymediamanager:5.3.22b34dc85099e
urllib3@2.6.3
2.7.0

Open the chart page →

7,944
prometheus-operatormesosphere12.11.131 of 8See more

prometheus-operator mesosphere 12.11.13

1 of the 8 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
urllib3@2.6.3
2.7.0

Open the chart page →

11,689
alluremidokura-communityVerified publisher0.1.31 of 2See more

allure midokura-community 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
frankescobar/allure-docker-service:2.19.0cafa03b94dac
python-pip@9.0.1-2.3~ubuntu1.18.04.5
no fix listed

Open the chart page →

12,847
pulsarmosquitto-helm-chart0.2.01 of 1See more

pulsar mosquitto-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.10.03b262ab7a7d9
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

15,675
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8b3b90af2a655
urllib3@2.6.3
2.7.0

Open the chart page →

4,960
radicalemt1905024.1.11 of 1See more

radicale mt190502 4.1.1

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
tomsquest/docker-radicale:3.6.1.0a594c624c5a6
urllib3@2.6.3
2.7.0

Open the chart page →

1,546
pagesmuthu-pages1.0.01 of 3See more

pages muthu-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagesnarain1.0.01 of 3See more

pages narain 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagesnarasimha-pages1.0.01 of 3See more

pages narasimha-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagesnavin-brixton1.0.01 of 3See more

pages navin-brixton 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
smilencsaVerified publisher1.1.03 of 23See more

smile ncsa 1.1.0

3 of the 23 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
socialmediamacroscope/autophrase:0.1.570fb11d4f531
python-pip@20.0.2-5ubuntu1.9
no fix listed
socialmediamacroscope/collect_reddit_comment:0.1.219d3d26d53ee
python-pip@9.0.1-2.3~ubuntu1.18.04.8
no fix listed
socialmediamacroscope/image_crawler:0.1.2f508216be63c
python-pip@9.0.1-2.3~ubuntu1.18.04.8
no fix listed

Open the chart page →

109,294
nominatimnominatim-chart1.3.01 of 3See more

nominatim nominatim-chart 1.3.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
mediagis/nominatim:3.7c15e941485ef
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

22,658
splashntppoolVerified publisher1.0.41 of 1See more

splash ntppool 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
scrapinghub/splash:3.4.1a5f89bc84606
python-pip@9.0.1-2.3~ubuntu1.18.04.1
no fix listed

Open the chart page →

27,633
octantisoctantis0.1.01 of 1See more

octantis octantis 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
ghcr.io/vinny1892/octantis:latest45459c0910fc
urllib3@2.6.3
2.7.0

Open the chart page →

2,555
mockoidcoidcmockVerified publisher0.0.11 of 1See more

mockoidc oidcmock 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
marcoimme/oidcmock:latestb6035c0721a8
urllib3@2.6.3
2.7.0

Open the chart page →

2,298
pulsarolehrgfVerified publisher0.0.51 of 2See more

pulsar olehrgf 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.1.016f9fdab3fa6
python-pip@22.0.2+dfsg-1ubuntu0.3
no fix listed

Open the chart page →

9,005
comacopencord1.0.02 of 9See more

comac opencord 1.0.0

2 of the 9 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
python-pip@8.1.1-2ubuntu0.4
no fix listed
omecproject/progran-synchronizer:comac-1.0.0d109a8e57e71
python-pip@8.1.1-2ubuntu0.4
no fix listed

Open the chart page →

88,546
comac-platformopencord0.0.171 of 11See more

comac-platform opencord 0.0.17

1 of the 11 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
python-pip@8.1.1-2ubuntu0.4
no fix listed

Open the chart page →

26,211
omec-control-planeopencord0.1.311 of 8See more

omec-control-plane opencord 0.1.31

1 of the 8 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
omecproject/mme-exporter:paging-latestbcc5f19fd676
python-pip@9.0.1-2.3~ubuntu1.18.04.1
no fix listed

Open the chart page →

40,715
ponsimv2opencord1.2.31 of 2See more

ponsimv2 opencord 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
voltha/voltha-tester:1.7.0655c3048a602
python-pip@8.1.1-2ubuntu0.4
no fix listed

Open the chart page →

12,609
sebaopencord1.0.04 of 17See more

seba opencord 1.0.0

4 of the 17 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
voltha/voltha-cli:1.6.0c4e41e92f046
python-pip@8.1.1-2ubuntu0.4
no fix listed
voltha/voltha-netconf:1.6.037f80524c207
python-pip@8.1.1-2ubuntu0.4
no fix listed
voltha/voltha-ofagent:1.6.09ee8c1f4428c
python-pip@8.1.1-2ubuntu0.4
no fix listed
voltha/voltha-voltha:1.6.0ff596b62de59
python-pip@8.1.1-2ubuntu0.4
no fix listed

Open the chart page →

93,855
openwhiskopenwhisk1.0.01 of 10See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
openwhisk/ow-utils:1.0.0c80dba0de3aa
python-pip@9.0.1-2.3~ubuntu1.18.04.4
no fix listed

Open the chart page →

36,215
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.06 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

6 of the 40 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
ghcr.io/openrelik/openrelik-metrics:latest3d0f1ddeebf5
urllib3@2.6.3
2.7.0
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestb175cc61959a
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed

Open the chart page →

71,208
loki-standaloneot-container-kit1.0.21 of 5See more

loki-standalone ot-container-kit 1.0.2

1 of the 5 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
quay.io/opstree/k8s-sidecar:2.7.126aa9bb3386b
urllib3@2.6.3
2.7.0

Open the chart page →

3,580
mysqlot-container-kit0.1.01 of 1See more

mysql ot-container-kit 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

463
p4p40.1.01 of 7See more

p4 p4 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8b3b90af2a655
urllib3@2.6.3
2.7.0

Open the chart page →

27,537
myappp4-helm0.1.01 of 6See more

myapp p4-helm 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8b3b90af2a655
urllib3@2.6.3
2.7.0

Open the chart page →

19,720
pagespages1.0.01 of 3See more

pages pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages101.0.01 of 3See more

pages pages10 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages1111.0.01 of 3See more

pages pages111 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages21.0.01 of 3See more

pages pages2 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages-alexchmielu1.0.01 of 3See more

pages pages-alexchmielu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages-alps1.0.01 of 3See more

pages pages-alps 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages-alstom1.0.01 of 3See more

pages pages-alstom 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages-ambala1.0.01 of 3See more

pages pages-ambala 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages-andromeda1.0.01 of 3See more

pages pages-andromeda 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespagesbadami1.0.01 of 3See more

pages pagesbadami 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages-blackburn1.0.01 of 3See more

pages pages-blackburn 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages-botes1.0.01 of 3See more

pages pages-botes 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages-brian1.0.01 of 3See more

pages pages-brian 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages-buckll1.0.01 of 3See more

pages pages-buckll 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages-camden1.0.01 of 3See more

pages pages-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages-camden7711.0.01 of 3See more

pages pages-camden771 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages-diarmuidkeane1.0.01 of 3See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages-draco1.0.01 of 3See more

pages pages-draco 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages-ellora1.0.01 of 3See more

pages pages-ellora 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages-finchley1.0.01 of 3See more

pages pages-finchley 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages-fornax1.0.01 of 3See more

pages pages-fornax 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190
pagespages-harsh1.0.01 of 3See more

pages pages-harsh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44432.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.7.0

Open the chart page →

20,190

Container images carrying it

206 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
urllib3@2.6.2
2.7.0
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
urllib3@2.6.2
2.7.0
1
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed
1
registry.gitlab.com/dyff/workflows-sink:0.16.3564718e28931
urllib3@2.6.3
2.7.0
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
python-pip@20.0.2-5ubuntu1.1
no fix listed
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
urllib3@2.6.2
2.7.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.