CVE-2026-44432
HighAdvisory
Published 11 May 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.9
- base score, highest
- EPSS
- 0.007
- 50th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 330
- of 17,781 indexed, latest versions
- Container images
- 206
- deployed by those charts
- Fix available
- 2 of 3
- affected packages
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
Carried by container images the latest versions of 330 of 17,781 indexed charts deploy, on 206 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| py3-pipapk | 25.0.1-r0, 25.2-r0, 26.0.1-r1 | 26.1.2-r1 | 3 |
| python-pipdeb | 1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+22 more | no fix listed | 107 |
| urllib3pypi | 2.6.0, 2.6.1, 2.6.2, 2.6.3 | 2.7.0 | 99 |
- OSV records
- CGA-63m6-2q77-9p47CGA-7w5f-j6gp-9573GHSA-mf9v-mfxr-j63jUBUNTU-CVE-2026-44432
- Also known as
- CGA-9f85-qpfh-pwpj, CGA-g9cf-jc7j-hpwm, PYSEC-2026-142
Charts affected
330 by stars
Container images carrying it
206 by charts deploying them
A fixed version is listed for 2 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| library/ | 7dcddc01f13b | urllib3 | 2.7.0 | 89 |
| library/ | b3b90af2a655 | urllib3 | 2.7.0 | 16 |
| quay.io/ | a6b3f707f883 | urllib3 | 2.7.0 | 13 |
| oomk8s/ | 875814cc853d | python-pip | no fix listed | 11 |
| library/ | 257388edf9c8 | urllib3 | 2.7.0 | 6 |
| oomk8s/ | 7daa08b81954 | python-pip | no fix listed | 6 |
| apache/ | 16b50bbef664 | urllib3 | 2.7.0 | 3 |
| cloudve/ | 4a3d7fae90bb | python-pip | no fix listed | 3 |
| alpine/ | 048f8d9c8cc7 | urllib3 | 2.7.0 | 2 |
| homebridge/ | 77c685a40911 | python-pip | no fix listed | 2 |
| library/ | b2cf29815e62 | urllib3 | 2.7.0 | 2 |
| memgraph/ | a1dc375774ed | python-pip | no fix listed | 2 |
| omecproject/ | cfdb566dd949 | python-pip | no fix listed | 2 |
| smartedge/ | 4cd63c22ce36 | python-pip | no fix listed | 2 |
| streamnative/ | 0e6d7aa3ef32 | python-pip | no fix listed | 2 |
| tzahi12345/ | 2f943d584711 | python-pip | no fix listed | 2 |
| ghcr.io/ | b1ba7b054af2 | python-pip | no fix listed | 2 |
| ghcr.io/ | 647a3c938d31 | urllib3 | 2.7.0 | 2 |
| registry.gitlab.com/ | b1198ea741d1 | urllib3 | 2.7.0 | 2 |
| a10networks/ | 8dc58d434d71 | python-pip | no fix listed | 1 |
| allegroai/ | 772827a01bb5 | python-pip | no fix listed | 1 |
| andrewgolikov55/ | fcc001b61c0e | python-pip | no fix listed | 1 |
| apachepulsar/ | 16f9fdab3fa6 | python-pip | no fix listed | 1 |
| apachepulsar/ | 3b262ab7a7d9 | python-pip | no fix listed | 1 |
| apachepulsar/ | 9c9947de139d | python-pip | no fix listed | 1 |
| apache/ | 76c176e8a0e4 | python-pip | no fix listed | 1 |
| appwrite/ | 1aaa70127114 | urllib3 | 2.7.0 | 1 |
| appwrite/ | adc7d0e7ec23 | urllib3 | 2.7.0 | 1 |
| archivebox/ | 1a5a37331091 | urllib3 | 2.7.0 | 1 |
| arunvelsriram/ | 655ad18fd8d6 | python-pip | no fix listed | 1 |
| assistiot/ | 30812ba93555 | python-pip | no fix listed | 1 |
| assistiot/ | e5ae539ce2cb | python-pip | no fix listed | 1 |
| bicarus/ | b1dab0721e1c | python-pip | no fix listed | 1 |
| blakeblackshear/ | ae269270ad9e | python-pip | no fix listed | 1 |
| boky/ | aafc77238423 | urllib3 | 2.7.0 | 1 |
| castai/ | da62858c8381 | urllib3 | 2.7.0 | 1 |
| chiefonboarding/ | 59bc7aa60fe7 | urllib3 | 2.7.0 | 1 |
| citizenstig/ | b81c818ccb86 | python-pip | no fix listed | 1 |
| cloudve/ | af56e77ca587 | python-pip | no fix listed | 1 |
| datamate/ | 2dd66b722464 | python-pip | no fix listed | 1 |
| dongjiang1989/ | 4bf9ae391948 | python-pip | no fix listed | 1 |
| dpage/ | 50700ac17936 | urllib3 | 2.7.0 | 1 |
| eclipseaerios/ | f55442e2c0ed | urllib3 | 2.7.0 | 1 |
| elautoestopista/ | 125ba620d528 | urllib3 | 2.7.0 | 1 |
| fiware/ | 29456835bb2c | python-pip | no fix listed | 1 |
| flashcatcloud/ | 421acb36181b | urllib3 | 2.7.0 | 1 |
| flyway/ | 45b5d7cdc75a | python-pip | no fix listed | 1 |
| frankescobar/ | 8a4d7e9308de | python-pip | no fix listed | 1 |
| frankescobar/ | cafa03b94dac | python-pip | no fix listed | 1 |
| galaxy/ | e5c265fe9fcd | python-pip | no fix listed | 1 |